Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities found for Job Management Partner 1/IT Desktop Management - Manager by Hitachi
CVE-2025-65116 (GCVE-0-2025-65116)
Vulnerability from nvd – Published: 2026-04-07 05:43 – Updated: 2026-04-07 13:25
VLAI?
Title
Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM
Summary
Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.
Severity ?
5.5 (Medium)
CWE
- CWE-763 - Release of invalid pointer or reference
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi | JP1/IT Desktop Management 2 - Manager |
Affected:
13-50 , < 13-50-02
(custom)
Affected: 13-11 , < 13-11-04 (custom) Affected: 13-10 , < 13-10-07 (custom) Affected: 13-01 , < 13-01-07 (custom) Affected: 13-00 , < 13-00-05 (custom) Affected: 12-60 , < 12-60-12 (custom) Affected: 10-50 , ≤ 12-50-11 (custom) |
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T13:25:49.919013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T13:25:56.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Operations Director",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Client",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Client",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ruslan Sayfiev"
},
{
"lang": "en",
"type": "finder",
"value": "Denis Faiustov"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.\u003cp\u003eThis issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.\u003c/p\u003e"
}
],
"value": "Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "CWE-763 Release of invalid pointer or reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T05:43:25.553Z",
"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"shortName": "Hitachi"
},
"references": [
{
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/index.html"
}
],
"source": {
"advisory": "hitachi-sec-2026-118",
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"assignerShortName": "Hitachi",
"cveId": "CVE-2025-65116",
"datePublished": "2026-04-07T05:43:25.553Z",
"dateReserved": "2025-11-18T01:27:41.899Z",
"dateUpdated": "2026-04-07T13:25:56.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65115 (GCVE-0-2025-65115)
Vulnerability from nvd – Published: 2026-04-07 05:19 – Updated: 2026-04-07 13:26
VLAI?
Title
Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM
Summary
Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.
Severity ?
8.8 (High)
CWE
- CWE-73 - External control of file name or path
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi | JP1/IT Desktop Management 2 - Manager |
Affected:
13-50 , < 13-50-02
(custom)
Affected: 13-11 , < 13-11-04 (custom) Affected: 13-10 , < 13-10-07 (custom) Affected: 13-01 , < 13-01-07 (custom) Affected: 13-00 , < 13-00-05 (custom) Affected: 12-60 , < 12-60-12 (custom) Affected: 10-50 , ≤ 12-50-11 (custom) |
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T13:26:13.754013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T13:26:20.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Operations Director",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Client",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Client",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ruslan Sayfiev"
},
{
"lang": "en",
"type": "finder",
"value": "Denis Faiustov"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Remote Code Execution Vulnerability\u0026nbsp;in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.\u003cp\u003eThis issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.\u003c/p\u003e"
}
],
"value": "Remote Code Execution Vulnerability\u00a0in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T05:19:50.413Z",
"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"shortName": "Hitachi"
},
"references": [
{
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/index.html"
}
],
"source": {
"advisory": "hitachi-sec-2026-118",
"discovery": "EXTERNAL"
},
"title": "Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"assignerShortName": "Hitachi",
"cveId": "CVE-2025-65115",
"datePublished": "2026-04-07T05:19:50.413Z",
"dateReserved": "2025-11-18T01:27:41.899Z",
"dateUpdated": "2026-04-07T13:26:20.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65116 (GCVE-0-2025-65116)
Vulnerability from cvelistv5 – Published: 2026-04-07 05:43 – Updated: 2026-04-07 13:25
VLAI?
Title
Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM
Summary
Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.
Severity ?
5.5 (Medium)
CWE
- CWE-763 - Release of invalid pointer or reference
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi | JP1/IT Desktop Management 2 - Manager |
Affected:
13-50 , < 13-50-02
(custom)
Affected: 13-11 , < 13-11-04 (custom) Affected: 13-10 , < 13-10-07 (custom) Affected: 13-01 , < 13-01-07 (custom) Affected: 13-00 , < 13-00-05 (custom) Affected: 12-60 , < 12-60-12 (custom) Affected: 10-50 , ≤ 12-50-11 (custom) |
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T13:25:49.919013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T13:25:56.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Operations Director",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Client",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Client",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ruslan Sayfiev"
},
{
"lang": "en",
"type": "finder",
"value": "Denis Faiustov"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.\u003cp\u003eThis issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.\u003c/p\u003e"
}
],
"value": "Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "CWE-763 Release of invalid pointer or reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T05:43:25.553Z",
"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"shortName": "Hitachi"
},
"references": [
{
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/index.html"
}
],
"source": {
"advisory": "hitachi-sec-2026-118",
"discovery": "EXTERNAL"
},
"title": "Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"assignerShortName": "Hitachi",
"cveId": "CVE-2025-65116",
"datePublished": "2026-04-07T05:43:25.553Z",
"dateReserved": "2025-11-18T01:27:41.899Z",
"dateUpdated": "2026-04-07T13:25:56.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65115 (GCVE-0-2025-65115)
Vulnerability from cvelistv5 – Published: 2026-04-07 05:19 – Updated: 2026-04-07 13:26
VLAI?
Title
Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM
Summary
Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.
Severity ?
8.8 (High)
CWE
- CWE-73 - External control of file name or path
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi | JP1/IT Desktop Management 2 - Manager |
Affected:
13-50 , < 13-50-02
(custom)
Affected: 13-11 , < 13-11-04 (custom) Affected: 13-10 , < 13-10-07 (custom) Affected: 13-01 , < 13-01-07 (custom) Affected: 13-00 , < 13-00-05 (custom) Affected: 12-60 , < 12-60-12 (custom) Affected: 10-50 , ≤ 12-50-11 (custom) |
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T13:26:13.754013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T13:26:20.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management 2 - Operations Director",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "13-50-02",
"status": "unaffected"
}
],
"lessThan": "13-50-02",
"status": "affected",
"version": "13-50",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-11-04",
"status": "unaffected"
}
],
"lessThan": "13-11-04",
"status": "affected",
"version": "13-11",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-10-07",
"status": "unaffected"
}
],
"lessThan": "13-10-07",
"status": "affected",
"version": "13-10",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-01-07",
"status": "unaffected"
}
],
"lessThan": "13-01-07",
"status": "affected",
"version": "13-01",
"versionType": "custom"
},
{
"changes": [
{
"at": "13-00-05",
"status": "unaffected"
}
],
"lessThan": "13-00-05",
"status": "affected",
"version": "13-00",
"versionType": "custom"
},
{
"changes": [
{
"at": "12-60-12",
"status": "unaffected"
}
],
"lessThan": "12-60-12",
"status": "affected",
"version": "12-60",
"versionType": "custom"
},
{
"lessThanOrEqual": "12-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management 2 - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-50-11",
"status": "affected",
"version": "10-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/IT Desktop Management - Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "10-10-16",
"status": "affected",
"version": "09-50",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Manager",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "JP1/NETM/DM Client",
"vendor": "Hitachi",
"versions": [
{
"changes": [
{
"at": "10-30",
"status": "unaffected"
}
],
"lessThanOrEqual": "10-20-02",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Manager",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Job Management Partner 1/Software Distribution Client",
"vendor": "Hitachi",
"versions": [
{
"lessThanOrEqual": "09-51-13",
"status": "affected",
"version": "09-00",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ruslan Sayfiev"
},
{
"lang": "en",
"type": "finder",
"value": "Denis Faiustov"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Remote Code Execution Vulnerability\u0026nbsp;in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.\u003cp\u003eThis issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.\u003c/p\u003e"
}
],
"value": "Remote Code Execution Vulnerability\u00a0in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T05:19:50.413Z",
"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"shortName": "Hitachi"
},
"references": [
{
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/index.html"
}
],
"source": {
"advisory": "hitachi-sec-2026-118",
"discovery": "EXTERNAL"
},
"title": "Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82",
"assignerShortName": "Hitachi",
"cveId": "CVE-2025-65115",
"datePublished": "2026-04-07T05:19:50.413Z",
"dateReserved": "2025-11-18T01:27:41.899Z",
"dateUpdated": "2026-04-07T13:26:20.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-201706-1000
Vulnerability from variot - Updated: 2026-03-09 20:52In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. Apache httpd Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apache HTTP Server is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to cause denial-of-service conditions. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed. The following versions are vulnerable: Apache HTTP Server 2.2.0 to 2.2.32 Apache HTTP Server 2.4.0 to 2.4.25. ========================================================================== Ubuntu Security Notice USN-3373-1 July 31, 2017
apache2 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Apache HTTP Server. This update adds a new ap_get_basic_auth_components() function for use by third-party modules. (CVE-2017-3167)
Vasileios Panopoulos discovered that the Apache mod_ssl module may crash when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. (CVE-2017-3169)
Javier JimA(c)nez discovered that the Apache HTTP Server incorrectly handled parsing certain requests. (CVE-2017-7679)
David Dennerline and RA(c)gis Leroy discovered that the Apache HTTP Server incorrectly handled unusual whitespace when parsing requests, contrary to specifications. This update may introduce compatibility issues with clients that do not strictly follow HTTP protocol specifications. A new configuration option "HttpProtocolOptions Unsafe" can be used to revert to the previous unsafe behaviour in problematic environments. (CVE-2016-8743)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 ESM: A apache2.2-binA A A A A A A A A A A A A A A A A A A 2.2.22-1ubuntu1.12
In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Important: httpd24-httpd security update Advisory ID: RHSA-2017:2483-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2017:2483 Issue date: 2017-08-16 CVE Names: CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 =====================================================================
- Summary:
An update for httpd24-httpd is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
Security Fix(es):
-
It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788)
-
It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167)
-
A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169)
-
A NULL pointer dereference flaw was found in the mod_http2 module of httpd. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP/2 request. (CVE-2017-7659)
-
A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668)
-
A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)
-
Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted automatically.
- Bugs fixed (https://bugzilla.redhat.com/):
1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass 1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference 1463199 - CVE-2017-7659 httpd: mod_http2 NULL pointer dereference 1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread 1463207 - CVE-2017-7679 httpd: mod_mime buffer overread 1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest
- Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):
Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):
Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2017-3167 https://access.redhat.com/security/cve/CVE-2017-3169 https://access.redhat.com/security/cve/CVE-2017-7659 https://access.redhat.com/security/cve/CVE-2017-7668 https://access.redhat.com/security/cve/CVE-2017-7679 https://access.redhat.com/security/cve/CVE-2017-9788 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iD8DBQFZlNCpXlSAg2UNWIIRArzwAJwNfAuroR6X18rUh+zmjiMy5iBkdwCeJF6e 4v4GwWYC+5xG0xxXzTEQyAg= =UV+2 -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 7.2) - ppc64, ppc64le, s390x, x86_64
-
(CVE-2017-7679)
-
A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. (CVE-2017-9798)
Red Hat would like to thank Hanno BAPck for reporting CVE-2017-9798. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.
This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 3 serves as an update to Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
- An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak. JIRA issues fixed (https://issues.jboss.org/):
JBCS-402 - Errata for httpd 2.4.23.SP3 RHEL7
7
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "http server",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.2.33"
},
{
"_id": null,
"model": "http server",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.4.26"
},
{
"_id": null,
"model": "http server",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.4.0"
},
{
"_id": null,
"model": "http server",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.2.0"
},
{
"_id": null,
"model": "jp1/automatic job management system 3",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager web console"
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support starter edition"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - operations director"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "(64)"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "express"
},
{
"_id": null,
"model": "tuning manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"_id": null,
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "professional for plug-in"
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- messaging"
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
},
{
"_id": null,
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "infrastructure analytics advisor",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- web console"
},
{
"_id": null,
"model": "tiered storage manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"_id": null,
"model": "ucosminexus developer standard",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "(64)"
},
{
"_id": null,
"model": "httpd",
"scope": "eq",
"trust": 0.8,
"vendor": "apache",
"version": "2.4.26"
},
{
"_id": null,
"model": "replication manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"_id": null,
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/automatic operation",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "01"
},
{
"_id": null,
"model": "global link manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "job management partner 1/performance management - web console",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"_id": null,
"model": "ucosminexus developer light",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"_id": null,
"model": "application server for developers",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"_id": null,
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"_id": null,
"model": "configuration manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus primary server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "base"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "st ard-r"
},
{
"_id": null,
"model": "ucosminexus primary server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "base(64)"
},
{
"_id": null,
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "httpd",
"scope": "eq",
"trust": 0.8,
"vendor": "apache",
"version": "2.2.33"
},
{
"_id": null,
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/service support",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "jp1/operations analytics",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "tuning manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "cosminexus http server",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/service support",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "starter edition"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "-r"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"_id": null,
"model": "global link manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"_id": null,
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus service architect",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus application server enterprise",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager web console"
},
{
"_id": null,
"model": "spoolserver/winspool series",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "reportfiling ver5.2 ~ 6.2"
},
{
"_id": null,
"model": "automation director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "tiered storage manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "ucosminexus application server standard",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "connexive pf",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "v6.5"
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "professional"
},
{
"_id": null,
"model": "httpd",
"scope": "lt",
"trust": 0.8,
"vendor": "apache",
"version": "2.2.x"
},
{
"_id": null,
"model": "replication manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "device manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "ucosminexus application server smart edition",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "application server",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "httpd",
"scope": "lt",
"trust": 0.8,
"vendor": "apache",
"version": "2.4.x"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.24"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.19"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.16"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.25"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.20"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.22"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.17"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.18"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.23"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.21"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "17.04"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "16.10"
},
{
"_id": null,
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "16.04"
},
{
"_id": null,
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "14.04"
},
{
"_id": null,
"model": "software collections for rhel",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "0"
},
{
"_id": null,
"model": "jboss web server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "0"
},
{
"_id": null,
"model": "jboss ews",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "2"
},
{
"_id": null,
"model": "jboss eap",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "jboss core services",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "1"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "i",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.1"
},
{
"_id": null,
"model": "i",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.3"
},
{
"_id": null,
"model": "i",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.52"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.52"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.09"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.033"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.029"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.11"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.4"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.3"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.2"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.9"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.8"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.7"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.6"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.4"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.3"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.11"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.10"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.0.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.7"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.6"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.4"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.3"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.2"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.13"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.12"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.11"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.4.27"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.43"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.39"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.27"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.25"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.21"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.19"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.17"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.15"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.13"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "centos",
"scope": "eq",
"trust": 0.3,
"vendor": "centos",
"version": "6"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.25"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.23"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.20"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.19"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.18"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.17"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.16"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.14"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.12"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.11"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.4"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.26"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.25"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.24"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.23"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.15"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.14"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.13"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.12"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.11"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.10"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.3"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.2"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.3"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.24"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.2"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.13"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.1"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.0"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.32"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.29"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.22"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.21"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.20"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.19"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.18"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.17"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.16"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.1"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.5"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.12"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.14"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.45"
},
{
"_id": null,
"model": "apache",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.26"
},
{
"_id": null,
"model": "2.2.33-dev",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "99170"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
},
{
"db": "NVD",
"id": "CVE-2017-7679"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apache:httpd",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:connexive_pf",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:spoolserver_winspool",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:cosminexus_http_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:hitachi_application_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:hitachi_application_server_for_developers",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:automation_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:compute_systems_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:configuration_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:device_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:global_link_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:infrastructure_analytics_advisor",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:replication_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:tiered_storage_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:tuning_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_performance_management_web_console",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_job_management_system_3",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_operation",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_operation_analytics",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_performance_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_service_support",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server_enterprise",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server_smart_edition",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server_standard",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer_light",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer_standard",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_primary_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_architect",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_platform",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
}
]
},
"credits": {
"_id": null,
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "145456"
},
{
"db": "PACKETSTORM",
"id": "144969"
}
],
"trust": 0.4
},
"cve": "CVE-2017-7679",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2017-7679",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-7679",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-7679",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-7679",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201704-572",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2017-7679",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-7679"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
},
{
"db": "NVD",
"id": "CVE-2017-7679"
}
]
},
"description": {
"_id": null,
"data": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. Apache httpd Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apache HTTP Server is prone to a buffer-overflow vulnerability. \nAn attacker can exploit this issue to cause denial-of-service conditions. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed. \nThe following versions are vulnerable:\nApache HTTP Server 2.2.0 to 2.2.32\nApache HTTP Server 2.4.0 to 2.4.25. ==========================================================================\nUbuntu Security Notice USN-3373-1\nJuly 31, 2017\n\napache2 vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in Apache HTTP Server. This update adds a\nnew ap_get_basic_auth_components() function for use by third-party\nmodules. (CVE-2017-3167)\n\nVasileios Panopoulos discovered that the Apache mod_ssl module may\ncrash when third-party modules call ap_hook_process_connection() during\nan HTTP request to an HTTPS port. (CVE-2017-3169)\n\nJavier JimA(c)nez discovered that the Apache HTTP Server incorrectly\nhandled parsing certain requests. (CVE-2017-7679)\n\nDavid Dennerline and RA(c)gis Leroy discovered that the Apache HTTP Server\nincorrectly handled unusual whitespace when parsing requests, contrary\nto specifications. This update may\nintroduce compatibility issues with clients that do not strictly follow\nHTTP protocol specifications. A new configuration option\n\"HttpProtocolOptions Unsafe\" can be used to revert to the previous\nunsafe behaviour in problematic environments. (CVE-2016-8743)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 12.04 ESM:\nA apache2.2-binA A A A A A A A A A A A A A A A A A A 2.2.22-1ubuntu1.12\n\nIn general, a standard system update will make all the necessary\nchanges. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: httpd24-httpd security update\nAdvisory ID: RHSA-2017:2483-01\nProduct: Red Hat Software Collections\nAdvisory URL: https://access.redhat.com/errata/RHSA-2017:2483\nIssue date: 2017-08-16\nCVE Names: CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 \n CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 \n=====================================================================\n\n1. Summary:\n\nAn update for httpd24-httpd is now available for Red Hat Software\nCollections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64\n\n3. \n\nSecurity Fix(es):\n\n* It was discovered that the httpd\u0027s mod_auth_digest module did not\nproperly initialize memory before using it when processing certain headers\nrelated to digest authentication. A remote attacker could possibly use this\nflaw to disclose potentially sensitive information or cause httpd child\nprocess to crash by sending specially crafted requests to a server. \n(CVE-2017-9788)\n\n* It was discovered that the use of httpd\u0027s ap_get_basic_auth_pw() API\nfunction outside of the authentication phase could lead to authentication\nbypass. A remote attacker could possibly use this flaw to bypass required\nauthentication if the API was used incorrectly by one of the modules used\nby httpd. (CVE-2017-3167)\n\n* A NULL pointer dereference flaw was found in the httpd\u0027s mod_ssl module. \nA remote attacker could use this flaw to cause an httpd child process to\ncrash if another module used by httpd called a certain API function during\nthe processing of an HTTPS request. (CVE-2017-3169)\n\n* A NULL pointer dereference flaw was found in the mod_http2 module of\nhttpd. A remote attacker could use this flaw to cause httpd child process\nto crash via a specially crafted HTTP/2 request. (CVE-2017-7659)\n\n* A buffer over-read flaw was found in the httpd\u0027s ap_find_token()\nfunction. A remote attacker could use this flaw to cause httpd child\nprocess to crash via a specially crafted HTTP request. (CVE-2017-7668)\n\n* A buffer over-read flaw was found in the httpd\u0027s mod_mime module. A user\npermitted to modify httpd\u0027s MIME configuration could use this flaw to cause\nhttpd child process to crash. (CVE-2017-7679)\n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted\nautomatically. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass\n1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference\n1463199 - CVE-2017-7659 httpd: mod_http2 NULL pointer dereference\n1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread\n1463207 - CVE-2017-7679 httpd: mod_mime buffer overread\n1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest\n\n6. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):\n\nSource:\nhttpd24-httpd-2.4.25-9.el6.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):\n\nSource:\nhttpd24-httpd-2.4.25-9.el6.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nhttpd24-httpd-2.4.25-9.el6.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nhttpd24-httpd-2.4.25-9.el7.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):\n\nSource:\nhttpd24-httpd-2.4.25-9.el7.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nhttpd24-httpd-2.4.25-9.el7.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-3167\nhttps://access.redhat.com/security/cve/CVE-2017-3169\nhttps://access.redhat.com/security/cve/CVE-2017-7659\nhttps://access.redhat.com/security/cve/CVE-2017-7668\nhttps://access.redhat.com/security/cve/CVE-2017-7679\nhttps://access.redhat.com/security/cve/CVE-2017-9788\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2017 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFZlNCpXlSAg2UNWIIRArzwAJwNfAuroR6X18rUh+zmjiMy5iBkdwCeJF6e\n4v4GwWYC+5xG0xxXzTEQyAg=\n=UV+2\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. 7.2) - ppc64, ppc64le, s390x, x86_64\n\n3. (CVE-2017-7679)\n\n* A use-after-free flaw was found in the way httpd handled invalid and\npreviously unregistered HTTP methods specified in the Limit directive used\nin an .htaccess file. (CVE-2017-9798)\n\nRed Hat would like to thank Hanno BAPck for reporting CVE-2017-9798. This software, such as Apache HTTP Server, is\ncommon to multiple JBoss middleware products, and is packaged under Red Hat\nJBoss Core Services to allow for faster distribution of updates, and for a\nmore consistent update experience. \n\nThis release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23\nService Pack 3 serves as an update to Red Hat JBoss Core Services Apache\nHTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are\ndocumented in the Release Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* An out-of-bounds array dereference was found in apr_time_exp_get(). An\nattacker could abuse an unvalidated usage of this function to cause a\ndenial of service or potentially lead to data leak. JIRA issues fixed (https://issues.jboss.org/):\n\nJBCS-402 - Errata for httpd 2.4.23.SP3 RHEL7\n\n7",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-7679"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
},
{
"db": "BID",
"id": "99170"
},
{
"db": "VULMON",
"id": "CVE-2017-7679"
},
{
"db": "PACKETSTORM",
"id": "143146"
},
{
"db": "PACKETSTORM",
"id": "143561"
},
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "145456"
},
{
"db": "PACKETSTORM",
"id": "144969"
}
],
"trust": 2.52
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2017-7679",
"trust": 3.4
},
{
"db": "BID",
"id": "99170",
"trust": 1.9
},
{
"db": "TENABLE",
"id": "TNS-2019-09",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1038711",
"trust": 1.6
},
{
"db": "JVN",
"id": "JVNVU98416507",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2017-7679",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143146",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143561",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143785",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144960",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "145456",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144969",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-7679"
},
{
"db": "BID",
"id": "99170"
},
{
"db": "PACKETSTORM",
"id": "143146"
},
{
"db": "PACKETSTORM",
"id": "143561"
},
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "145456"
},
{
"db": "PACKETSTORM",
"id": "144969"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
},
{
"db": "NVD",
"id": "CVE-2017-7679"
}
]
},
"id": "VAR-201706-1000",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.206875005
},
"last_update_date": "2026-03-09T20:52:51.023000Z",
"patch": {
"_id": null,
"data": [
{
"title": "hitachi-sec-2018-101",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2018-101/index.html"
},
{
"title": "hitachi-sec-2018-103",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2018-103/index.html"
},
{
"title": "hitachi-sec-2017-123",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-123/index.html"
},
{
"title": "NV17-014",
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv17-014.html"
},
{
"title": "CVE-2017-7679: mod_mime buffer overread",
"trust": 0.8,
"url": "https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751@%3Cdev.httpd.apache.org%3E"
},
{
"title": "hitachi-sec-2017-123",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-123/index.html"
},
{
"title": "hitachi-sec-2018-101",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2018-101/index.html"
},
{
"title": "hitachi-sec-2018-103",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2018-103/index.html"
},
{
"title": "Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89482"
},
{
"title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173477 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173476 - Security Advisory"
},
{
"title": "Red Hat: Important: httpd security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173194 - Security Advisory"
},
{
"title": "Red Hat: Important: httpd security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173193 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173475 - Security Advisory"
},
{
"title": "Red Hat: Important: httpd security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173195 - Security Advisory"
},
{
"title": "Red Hat: CVE-2017-7679",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2017-7679"
},
{
"title": "Ubuntu Security Notice: apache2 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3340-1"
},
{
"title": "Arch Linux Issues: ",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2017-7679"
},
{
"title": "Ubuntu Security Notice: apache2 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3373-1"
},
{
"title": "Debian Security Advisories: DSA-3896-1 apache2 -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=a100e91e6529637522c4f74492953f8c"
},
{
"title": "Amazon Linux AMI: ALAS-2017-892",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2017-892"
},
{
"title": "Amazon Linux AMI: ALAS-2017-863",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2017-863"
},
{
"title": "Arch Linux Advisories: [ASA-201706-34] apache: multiple issues",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201706-34"
},
{
"title": "Symantec Security Advisories: SA154: Apache httpd Vulnerabilities June 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=6f891c1513dfb5c26769ed38bcac6e4f"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a22ad41e97bbfc5abb0bb927bf43089c"
},
{
"title": "Tenable Security Advisories: [R1] Tenable.sc 5.13.0 Fixes Multiple Third-Party Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories\u0026qid=TNS-2019-09"
},
{
"title": "Oracle Linux Bulletins: Oracle Linux Bulletin - July 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins\u0026qid=549dc795290b298746065b62b4bb7928"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - October 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=523d3f220a64ff01dd95e064bd37566a"
},
{
"title": "POC",
"trust": 0.1,
"url": "https://github.com/j031t/POC "
},
{
"title": "Shodan",
"trust": 0.1,
"url": "https://github.com/averna-syd/Shodan "
},
{
"title": "netlas-go",
"trust": 0.1,
"url": "https://github.com/mmpx12/netlas-go "
},
{
"title": "watchdog",
"trust": 0.1,
"url": "https://github.com/flipkart-incubator/watchdog "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/catdever/watchdog "
},
{
"title": "watchdog",
"trust": 0.1,
"url": "https://github.com/rohankumardubey/watchdog "
},
{
"title": "nrich",
"trust": 0.1,
"url": "https://github.com/retr0-13/nrich "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/RoseSecurity-Research/Red-Teaming-TTPs "
},
{
"title": "Red-Teaming-TTPs",
"trust": 0.1,
"url": "https://github.com/RoseSecurity/Red-Teaming-TTPs "
},
{
"title": "Shodan-nrich",
"trust": 0.1,
"url": "https://github.com/PawanKumarPandit/Shodan-nrich "
},
{
"title": "DC-3-Vulnhub-Walkthrough",
"trust": 0.1,
"url": "https://github.com/vshaliii/DC-3-Vulnhub-Walkthrough "
},
{
"title": "DC-2-Vulnhub-Walkthrough",
"trust": 0.1,
"url": "https://github.com/vshaliii/DC-2-Vulnhub-Walkthrough "
},
{
"title": "DC-1-Vulnhub-Walkthrough",
"trust": 0.1,
"url": "https://github.com/vshaliii/DC-1-Vulnhub-Walkthrough "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/hrbrmstr/internetdb "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/SecureAxom/strike "
},
{
"title": "pigat",
"trust": 0.1,
"url": "https://github.com/syadg123/pigat "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-7679"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
},
{
"problemtype": "CWE-126",
"trust": 1.0
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
},
{
"db": "NVD",
"id": "CVE-2017-7679"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:2483"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:3193"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:3476"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:3195"
},
{
"trust": 1.6,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbux03908en_us"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:3477"
},
{
"trust": 1.6,
"url": "https://security.gentoo.org/glsa/201710-32"
},
{
"trust": 1.6,
"url": "https://support.apple.com/ht208221"
},
{
"trust": 1.6,
"url": "https://github.com/gottburgm/exploits/tree/master/cve-2017-7679"
},
{
"trust": 1.6,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03821en_us"
},
{
"trust": 1.6,
"url": "https://security.netapp.com/advisory/ntap-20180601-0002/"
},
{
"trust": 1.6,
"url": "http://www.debian.org/security/2017/dsa-3896"
},
{
"trust": 1.6,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/99170"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id/1038711"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:2478"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:2479"
},
{
"trust": 1.6,
"url": "https://www.nomachine.com/su08o00185"
},
{
"trust": 1.6,
"url": "https://www.tenable.com/security/tns-2019-09"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:3194"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:3475"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7679"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751%40%3cdev.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7679"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98416507/"
},
{
"trust": 0.7,
"url": "https://access.redhat.com/security/cve/cve-2017-7679"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3167"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3169"
},
{
"trust": 0.6,
"url": "httpd.apache.org%3e"
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751@%3cdev."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3ccvs."
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7668"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2017-3167"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.4,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2017-3169"
},
{
"trust": 0.4,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.3,
"url": "http://www.apache.org/"
},
{
"trust": 0.3,
"url": "https://httpd.apache.org/"
},
{
"trust": 0.3,
"url": "https://www.apache.org/dist/httpd/patches/apply_to_2.2.32/cve-2017-7679.patch"
},
{
"trust": 0.3,
"url": "https://httpd.apache.org/security/vulnerabilities_22.html"
},
{
"trust": 0.3,
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg24043880"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8n1022204"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg22005280"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-9788"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9788"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-9798"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9798"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2017-7668"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.7-1ubuntu4.16"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu4.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.25-3ubuntu2.1"
},
{
"trust": 0.1,
"url": "https://www.ubuntu.com/usn/usn-3340-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu3.3"
},
{
"trust": 0.1,
"url": "https://www.ubuntu.com/usn/usn-3373-1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-8743"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7659"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-7659"
},
{
"trust": 0.1,
"url": "https://issues.jboss.org/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-12613"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12613"
}
],
"sources": [
{
"db": "BID",
"id": "99170"
},
{
"db": "PACKETSTORM",
"id": "143146"
},
{
"db": "PACKETSTORM",
"id": "143561"
},
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "145456"
},
{
"db": "PACKETSTORM",
"id": "144969"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
},
{
"db": "NVD",
"id": "CVE-2017-7679"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "VULMON",
"id": "CVE-2017-7679",
"ident": null
},
{
"db": "BID",
"id": "99170",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "143146",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "143561",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "143785",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "144960",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "145456",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "144969",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005026",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2017-7679",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2017-06-20T00:00:00",
"db": "VULMON",
"id": "CVE-2017-7679",
"ident": null
},
{
"date": "2017-06-19T00:00:00",
"db": "BID",
"id": "99170",
"ident": null
},
{
"date": "2017-06-26T23:34:52",
"db": "PACKETSTORM",
"id": "143146",
"ident": null
},
{
"date": "2017-07-31T18:22:22",
"db": "PACKETSTORM",
"id": "143561",
"ident": null
},
{
"date": "2017-08-16T23:35:53",
"db": "PACKETSTORM",
"id": "143785",
"ident": null
},
{
"date": "2017-11-13T22:23:00",
"db": "PACKETSTORM",
"id": "144960",
"ident": null
},
{
"date": "2017-12-17T15:28:41",
"db": "PACKETSTORM",
"id": "145456",
"ident": null
},
{
"date": "2017-11-14T04:32:14",
"db": "PACKETSTORM",
"id": "144969",
"ident": null
},
{
"date": "2017-04-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-572",
"ident": null
},
{
"date": "2017-07-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005026",
"ident": null
},
{
"date": "2017-06-20T01:29:00.423000",
"db": "NVD",
"id": "CVE-2017-7679",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2017-7679",
"ident": null
},
{
"date": "2017-08-16T08:10:00",
"db": "BID",
"id": "99170",
"ident": null
},
{
"date": "2021-06-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-572",
"ident": null
},
{
"date": "2018-02-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005026",
"ident": null
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-7679",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "144969"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-572"
}
],
"trust": 0.9
},
"title": {
"_id": null,
"data": "Apache httpd Buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005026"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201704-572"
}
],
"trust": 0.6
}
}
VAR-201705-3649
Vulnerability from variot - Updated: 2026-03-09 20:09There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem. OpenSSL There is a service disruption ( crash ) There are vulnerabilities that are put into a state.Service operation interruption ( crash ) There is a possibility of being put into a state.
This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
OpenSSL 1.1.0 users should upgrade to 1.1.0g OpenSSL 1.0.2 users should upgrade to 1.0.2m
This issue was reported to OpenSSL on 10th August 2017 by the OSS-Fuzz project. The fix was developed by Andy Polyakov of the OpenSSL development team.
Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
Severity: Low
This issue was previously announced in security advisory https://www.openssl.org/news/secadv/20170828.txt, but the fix has not previously been included in a release due to its low severity.
OpenSSL 1.1.0 users should upgrade to 1.1.0g OpenSSL 1.0.2 users should upgrade to 1.0.2m
Note
Support for version 1.0.1 ended on 31st December 2016. Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates.
References
URL for this Security Advisory: https://www.openssl.org/news/secadv/20171102.txt
Note: the online version of the advisory may be updated with additional details over time.
For details of OpenSSL severity classifications please see: https://www.openssl.org/policies/secpolicy.html . Solution:
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).
After installing the updated packages, the httpd daemon will be restarted automatically.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
[slackware-security] openssl (SSA:2017-041-02)
New openssl packages are available for Slackware 14.2 and -current to fix security issues.
Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/openssl-1.0.2k-i586-1_slack14.2.txz: Upgraded. This update fixes security issues: Truncated packet could crash via OOB read (CVE-2017-3731) BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732) Montgomery multiplication may produce incorrect results (CVE-2016-7055) For more information, see: https://www.openssl.org/news/secadv/20170126.txt https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3731 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7055 ( Security fix ) patches/packages/openssl-solibs-1.0.2k-i586-1_slack14.2.txz: Upgraded. +--------------------------+
Where to find the new packages: +-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.
Updated packages for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-1.0.2k-i586-1_slack14.2.txz ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-solibs-1.0.2k-i586-1_slack14.2.txz
Updated packages for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-1.0.2k-x86_64-1_slack14.2.txz ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-solibs-1.0.2k-x86_64-1_slack14.2.txz
Updated packages for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-1.0.2k-i586-1.txz ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-1.0.2k-i586-1.txz
Updated packages for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/openssl-solibs-1.0.2k-x86_64-1.txz ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssl-1.0.2k-x86_64-1.txz
MD5 signatures: +-------------+
Slackware 14.2 packages: 1d03d7f59dece41b97104cbe8341b812 openssl-1.0.2k-i586-1_slack14.2.txz c5e689d9ac1c1675c5059b8e7cd42594 openssl-solibs-1.0.2k-i586-1_slack14.2.txz
Slackware x86_64 14.2 packages: 5e075d516ab7ccc1ef14f430e599bdef openssl-1.0.2k-x86_64-1_slack14.2.txz 110479b47a4208bcdb43fee59b9f06ca openssl-solibs-1.0.2k-x86_64-1_slack14.2.txz
Slackware -current packages: 8eca7a113cf58688dc6203c4091fd0ac a/openssl-solibs-1.0.2k-i586-1.txz 1ee03441f6409e48dda42c006ae5a7ad n/openssl-1.0.2k-i586-1.txz
Slackware x86_64 -current packages: 51ed87062d6898bd50705b2c2abc2c68 a/openssl-solibs-1.0.2k-x86_64-1.txz d9e56ff59fd7aa5791bf6809ccea0f92 n/openssl-1.0.2k-x86_64-1.txz
Installation instructions: +------------------------+
Upgrade the packages as root:
upgradepkg openssl-1.0.2k-i586-1_slack14.2.txz openssl-solibs-1.0.2k-i586-1_slack14.2.txz
+-----+
Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com
+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201802-04
https://security.gentoo.org/
Severity: High Title: MySQL: Multiple vulnerabilities Date: February 20, 2018 Bugs: #616486, #625626, #634652, #644986 ID: 201802-04
Synopsis
Multiple vulnerabilities were found in MySQL, the worst of which may allow remote execution of arbitrary code.
Background
A fast, multi-threaded, multi-user SQL database server.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-db/mysql < 5.6.39 >= 5.6.39
Description
Multiple vulnerabilities have been discovered in MySQL. Please review the referenced CVE identifiers for details.
Impact
A remote attacker could execute arbitrary code without authentication or cause a partial denial of service condition.
Workaround
There are no known workarounds at this time.
Resolution
All MySQL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/mysql-5.6.39"
References
[ 1 ] CVE-2017-10155 https://nvd.nist.gov/vuln/detail/CVE-2017-10155 [ 2 ] CVE-2017-10227 https://nvd.nist.gov/vuln/detail/CVE-2017-10227 [ 3 ] CVE-2017-10268 https://nvd.nist.gov/vuln/detail/CVE-2017-10268 [ 4 ] CVE-2017-10276 https://nvd.nist.gov/vuln/detail/CVE-2017-10276 [ 5 ] CVE-2017-10283 https://nvd.nist.gov/vuln/detail/CVE-2017-10283 [ 6 ] CVE-2017-10286 https://nvd.nist.gov/vuln/detail/CVE-2017-10286 [ 7 ] CVE-2017-10294 https://nvd.nist.gov/vuln/detail/CVE-2017-10294 [ 8 ] CVE-2017-10314 https://nvd.nist.gov/vuln/detail/CVE-2017-10314 [ 9 ] CVE-2017-10378 https://nvd.nist.gov/vuln/detail/CVE-2017-10378 [ 10 ] CVE-2017-10379 https://nvd.nist.gov/vuln/detail/CVE-2017-10379 [ 11 ] CVE-2017-10384 https://nvd.nist.gov/vuln/detail/CVE-2017-10384 [ 12 ] CVE-2017-3308 https://nvd.nist.gov/vuln/detail/CVE-2017-3308 [ 13 ] CVE-2017-3309 https://nvd.nist.gov/vuln/detail/CVE-2017-3309 [ 14 ] CVE-2017-3329 https://nvd.nist.gov/vuln/detail/CVE-2017-3329 [ 15 ] CVE-2017-3450 https://nvd.nist.gov/vuln/detail/CVE-2017-3450 [ 16 ] CVE-2017-3452 https://nvd.nist.gov/vuln/detail/CVE-2017-3452 [ 17 ] CVE-2017-3453 https://nvd.nist.gov/vuln/detail/CVE-2017-3453 [ 18 ] CVE-2017-3456 https://nvd.nist.gov/vuln/detail/CVE-2017-3456 [ 19 ] CVE-2017-3461 https://nvd.nist.gov/vuln/detail/CVE-2017-3461 [ 20 ] CVE-2017-3462 https://nvd.nist.gov/vuln/detail/CVE-2017-3462 [ 21 ] CVE-2017-3463 https://nvd.nist.gov/vuln/detail/CVE-2017-3463 [ 22 ] CVE-2017-3464 https://nvd.nist.gov/vuln/detail/CVE-2017-3464 [ 23 ] CVE-2017-3599 https://nvd.nist.gov/vuln/detail/CVE-2017-3599 [ 24 ] CVE-2017-3600 https://nvd.nist.gov/vuln/detail/CVE-2017-3600 [ 25 ] CVE-2017-3633 https://nvd.nist.gov/vuln/detail/CVE-2017-3633 [ 26 ] CVE-2017-3634 https://nvd.nist.gov/vuln/detail/CVE-2017-3634 [ 27 ] CVE-2017-3635 https://nvd.nist.gov/vuln/detail/CVE-2017-3635 [ 28 ] CVE-2017-3636 https://nvd.nist.gov/vuln/detail/CVE-2017-3636 [ 29 ] CVE-2017-3637 https://nvd.nist.gov/vuln/detail/CVE-2017-3637 [ 30 ] CVE-2017-3641 https://nvd.nist.gov/vuln/detail/CVE-2017-3641 [ 31 ] CVE-2017-3647 https://nvd.nist.gov/vuln/detail/CVE-2017-3647 [ 32 ] CVE-2017-3648 https://nvd.nist.gov/vuln/detail/CVE-2017-3648 [ 33 ] CVE-2017-3649 https://nvd.nist.gov/vuln/detail/CVE-2017-3649 [ 34 ] CVE-2017-3651 https://nvd.nist.gov/vuln/detail/CVE-2017-3651 [ 35 ] CVE-2017-3652 https://nvd.nist.gov/vuln/detail/CVE-2017-3652 [ 36 ] CVE-2017-3653 https://nvd.nist.gov/vuln/detail/CVE-2017-3653 [ 37 ] CVE-2017-3732 https://nvd.nist.gov/vuln/detail/CVE-2017-3732 [ 38 ] CVE-2018-2562 https://nvd.nist.gov/vuln/detail/CVE-2018-2562 [ 39 ] CVE-2018-2573 https://nvd.nist.gov/vuln/detail/CVE-2018-2573 [ 40 ] CVE-2018-2583 https://nvd.nist.gov/vuln/detail/CVE-2018-2583 [ 41 ] CVE-2018-2590 https://nvd.nist.gov/vuln/detail/CVE-2018-2590 [ 42 ] CVE-2018-2591 https://nvd.nist.gov/vuln/detail/CVE-2018-2591 [ 43 ] CVE-2018-2612 https://nvd.nist.gov/vuln/detail/CVE-2018-2612 [ 44 ] CVE-2018-2622 https://nvd.nist.gov/vuln/detail/CVE-2018-2622 [ 45 ] CVE-2018-2640 https://nvd.nist.gov/vuln/detail/CVE-2018-2640 [ 46 ] CVE-2018-2645 https://nvd.nist.gov/vuln/detail/CVE-2018-2645 [ 47 ] CVE-2018-2647 https://nvd.nist.gov/vuln/detail/CVE-2018-2647 [ 48 ] CVE-2018-2665 https://nvd.nist.gov/vuln/detail/CVE-2018-2665 [ 49 ] CVE-2018-2668 https://nvd.nist.gov/vuln/detail/CVE-2018-2668 [ 50 ] CVE-2018-2696 https://nvd.nist.gov/vuln/detail/CVE-2018-2696 [ 51 ] CVE-2018-2703 https://nvd.nist.gov/vuln/detail/CVE-2018-2703
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201802-04
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. Description:
This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.
This release upgrades OpenSSL to version 1.0.2.n
Security Fix(es):
-
openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182)
-
openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302)
-
openssl: certificate message OOB reads (CVE-2016-6306)
-
openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055)
-
openssl: Truncated packet could crash via OOB read (CVE-2017-3731)
-
openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
-
openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
-
openssl: Read/write after SSL object in error state (CVE-2017-3737)
-
openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):
1367340 - CVE-2016-2182 openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() 1369855 - CVE-2016-6302 openssl: Insufficient TLS session ticket HMAC length checks 1377594 - CVE-2016-6306 openssl: certificate message OOB reads 1393929 - CVE-2016-7055 openssl: Carry propagating bug in Montgomery multiplication 1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read 1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64 1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64 1523504 - CVE-2017-3737 openssl: Read/write after SSL object in error state 1523510 - CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
- JIRA issues fixed (https://issues.jboss.org/):
JBCS-373 - Errata for httpd 2.4.29 GA RHEL 7
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: java-1.8.0-ibm security update Advisory ID: RHSA-2018:2575-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://access.redhat.com/errata/RHSA-2018:2575 Issue date: 2018-08-28 CVE Names: CVE-2016-0705 CVE-2017-3732 CVE-2017-3736 CVE-2018-1517 CVE-2018-1656 CVE-2018-2940 CVE-2018-2952 CVE-2018-2973 CVE-2018-12539 ==================================================================== 1. Summary:
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
- Description:
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP20.
Security Fix(es):
-
IBM JDK: privilege escalation via insufficiently restricted access to Attach API (CVE-2018-12539)
-
openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
-
openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
-
IBM JDK: DoS in the java.math component (CVE-2018-1517)
-
IBM JDK: path traversal flaw in the Diagnostic Tooling Framework (CVE-2018-1656)
-
Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries) (CVE-2018-2940)
-
OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) (CVE-2018-2952)
-
Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE) (CVE-2018-2973)
-
OpenSSL: Double-free in DSA code (CVE-2016-0705)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank the OpenSSL project for reporting CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the original reporter of CVE-2016-0705.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
1310596 - CVE-2016-0705 OpenSSL: Double-free in DSA code 1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64 1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64 1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) 1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE) 1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries) 1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API 1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework 1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component
- Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm
x86_64: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
x86_64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm
ppc64: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.ppc64.rpm
s390x: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.s390x.rpm
x86_64: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm
x86_64: java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2016-0705 https://access.redhat.com/security/cve/CVE-2017-3732 https://access.redhat.com/security/cve/CVE-2017-3736 https://access.redhat.com/security/cve/CVE-2018-1517 https://access.redhat.com/security/cve/CVE-2018-1656 https://access.redhat.com/security/cve/CVE-2018-2940 https://access.redhat.com/security/cve/CVE-2018-2952 https://access.redhat.com/security/cve/CVE-2018-2973 https://access.redhat.com/security/cve/CVE-2018-12539 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBW4WgLdzjgjWX9erEAQixyw//d2pemlb2TNR2kW3WlrxY0KBjUBM+PS4i bQ8+SoNsct2XtVFq0oOfwAmYMn++pAY37yvvhUdefe5sAcUldDcJtLIgXbtISSXe V5EdrLvQbv/rSxikOfccFzNI8GwJTgGiLpq8n9exHcSsY5cZevzukgRr6b+yQbnj mcYEC3TB/CnulDac/Pt0VsS9AoFhwuX958/+EQdpMq1yOGqog6eM8U6x2btA4YSi mcVD2hom6GuYMKq0oWDPWPry5hJePvbPM6GZw8pYdRvA1eKjp24M3mkWkkIEFw6U aZCW6YXJuwMMJ4IYbF1Aofm3ab+R1VZXmPvzMHXRhVcRyZLvBzo1fZaw7ISX1ibV FimDRrXLIJDudoS80DMVmbgQTL37U6pGAe6gV2JLtvtEZl02Sxq5PeRfuMME4qeP rT+xyz0zjyIqTpxhAzAQJ28ZCrWDvRycCT5ZLwaPfxZ0+4cY1l58TMfYpdwIKJSC M8HQccrNxQ8S/kSKexIT18mSQcMwOhDza6gV4hSiOQgI/xHW3sic78a7/74JnSBT DgZuicAq73IWdYu67B04UzsZNsySSW6vs3BeYdfN5BnmK40NxrH5d5LMRV4xKmN+ HlkzX1CrDCBl9PtbQF0xpUGluvXCg1u2kzGHj4Dv7JP64bV1wXmLm5kwrPL/QZhv 8IL8kIZinC8=eoiE -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.6,
"vendor": "openssl",
"version": "1.0.2a"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.6,
"vendor": "openssl",
"version": "1.0.2d"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.6,
"vendor": "openssl",
"version": "1.0.2b"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.6,
"vendor": "openssl",
"version": "1.0.2e"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.6,
"vendor": "openssl",
"version": "1.0.2c"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.6,
"vendor": "openssl",
"version": "1.0.2f"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.6,
"vendor": "openssl",
"version": "1.0.2"
},
{
"_id": null,
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "6.9.0"
},
{
"_id": null,
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.7.3"
},
{
"_id": null,
"model": "node.js",
"scope": "lte",
"trust": 1.0,
"vendor": "nodejs",
"version": "6.8.1"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2h"
},
{
"_id": null,
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "5.0.0"
},
{
"_id": null,
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "7.5.0"
},
{
"_id": null,
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.0.0"
},
{
"_id": null,
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "7.0.0"
},
{
"_id": null,
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "6.0.0"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.1.0a"
},
{
"_id": null,
"model": "node.js",
"scope": "lte",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.1.2"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.1.0c"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.1.0b"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2i"
},
{
"_id": null,
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.2.0"
},
{
"_id": null,
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "6.9.5"
},
{
"_id": null,
"model": "node.js",
"scope": "lte",
"trust": 1.0,
"vendor": "nodejs",
"version": "5.12.0"
},
{
"_id": null,
"model": "jp1/automatic job management system 3",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager web console"
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support starter edition"
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 0.8,
"vendor": "openssl",
"version": "1.1.0d"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - operations director"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "(64)"
},
{
"_id": null,
"model": "openssl",
"scope": "lt",
"trust": 0.8,
"vendor": "openssl",
"version": "1.1.0"
},
{
"_id": null,
"model": "systemdirector enterprise",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"_id": null,
"model": "enterprisedirectoryserver",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "all versions"
},
{
"_id": null,
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"_id": null,
"model": "webotx application server",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "foundation"
},
{
"_id": null,
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- web console"
},
{
"_id": null,
"model": "express5800",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "/sg all versions"
},
{
"_id": null,
"model": "webotx enterprise service bus",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"_id": null,
"model": "openssl",
"scope": "eq",
"trust": 0.8,
"vendor": "openssl",
"version": "1.0.2k"
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "(64)"
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"_id": null,
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/automatic operation",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "job management partner 1/performance management - web console",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"_id": null,
"model": "webotx application server",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "st ard"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"_id": null,
"model": "ucosminexus primary server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "base"
},
{
"_id": null,
"model": "ucosminexus primary server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "base(64)"
},
{
"_id": null,
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/service support",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "jp1/operations analytics",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/service support",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "starter edition"
},
{
"_id": null,
"model": "cosminexus http server",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "-r"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"_id": null,
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus service architect",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "webotx application server",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "express"
},
{
"_id": null,
"model": "esmpro/serveragentservice",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "all versions (linux edition )"
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager web console"
},
{
"_id": null,
"model": "openssl",
"scope": "lt",
"trust": 0.8,
"vendor": "openssl",
"version": "1.0.2"
},
{
"_id": null,
"model": "webotx portal",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "webotx application server",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "enterprise"
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
},
{
"db": "NVD",
"id": "CVE-2017-3732"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:openssl:openssl",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:enterprise_directoryserver",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:esmpro_serveragent",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:esmpro_serveragentservice",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:express5800",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:systemdirector_enterprise",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:webotx_application_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:webotx_enterprise_service_bus",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:webotx_portal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:cosminexus_http_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_performance_management_web_console",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_job_management_system_3",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_operation",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_operation_analytics",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_performance_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_service_support",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_primary_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_architect",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_platform",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
}
]
},
"credits": {
"_id": null,
"data": "The vulnerability is caused by OpenSSL Official website disclosure.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
}
],
"trust": 0.6
},
"cve": "CVE-2017-3732",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-3732",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"id": "CVE-2017-3732",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.9,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-3732",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-3732",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-3732",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201702-216",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-3732",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-3732"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
},
{
"db": "NVD",
"id": "CVE-2017-3732"
}
]
},
"description": {
"_id": null,
"data": "There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem. OpenSSL There is a service disruption ( crash ) There are vulnerabilities that are put into a state.Service operation interruption ( crash ) There is a possibility of being put into a state. \n\nThis only affects processors that support the BMI1, BMI2 and ADX extensions like\nIntel Broadwell (5th generation) and later or AMD Ryzen. \n\nOpenSSL 1.1.0 users should upgrade to 1.1.0g\nOpenSSL 1.0.2 users should upgrade to 1.0.2m\n\nThis issue was reported to OpenSSL on 10th August 2017 by the OSS-Fuzz project. \nThe fix was developed by Andy Polyakov of the OpenSSL development team. \n\nMalformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)\n====================================================================\n\nSeverity: Low\n\nThis issue was previously announced in security advisory\nhttps://www.openssl.org/news/secadv/20170828.txt, but the fix has not previously\nbeen included in a release due to its low severity. \n\nOpenSSL 1.1.0 users should upgrade to 1.1.0g\nOpenSSL 1.0.2 users should upgrade to 1.0.2m\n\n\nNote\n====\n\nSupport for version 1.0.1 ended on 31st December 2016. Support for versions\n0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer\nreceiving security updates. \n\nReferences\n==========\n\nURL for this Security Advisory:\nhttps://www.openssl.org/news/secadv/20171102.txt\n\nNote: the online version of the advisory may be updated with additional details\nover time. \n\nFor details of OpenSSL severity classifications please see:\nhttps://www.openssl.org/policies/secpolicy.html\n. Solution:\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files). \n\nAfter installing the updated packages, the httpd daemon will be restarted\nautomatically. \n\n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n[slackware-security] openssl (SSA:2017-041-02)\n\nNew openssl packages are available for Slackware 14.2 and -current to\nfix security issues. \n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n+--------------------------+\npatches/packages/openssl-1.0.2k-i586-1_slack14.2.txz: Upgraded. \n This update fixes security issues:\n Truncated packet could crash via OOB read (CVE-2017-3731)\n BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)\n Montgomery multiplication may produce incorrect results (CVE-2016-7055)\n For more information, see:\n https://www.openssl.org/news/secadv/20170126.txt\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3731\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3732\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7055\n (* Security fix *)\npatches/packages/openssl-solibs-1.0.2k-i586-1_slack14.2.txz: Upgraded. \n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-1.0.2k-i586-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-solibs-1.0.2k-i586-1_slack14.2.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-1.0.2k-x86_64-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-solibs-1.0.2k-x86_64-1_slack14.2.txz\n\nUpdated packages for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-1.0.2k-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-1.0.2k-i586-1.txz\n\nUpdated packages for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/openssl-solibs-1.0.2k-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssl-1.0.2k-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 14.2 packages:\n1d03d7f59dece41b97104cbe8341b812 openssl-1.0.2k-i586-1_slack14.2.txz\nc5e689d9ac1c1675c5059b8e7cd42594 openssl-solibs-1.0.2k-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 packages:\n5e075d516ab7ccc1ef14f430e599bdef openssl-1.0.2k-x86_64-1_slack14.2.txz\n110479b47a4208bcdb43fee59b9f06ca openssl-solibs-1.0.2k-x86_64-1_slack14.2.txz\n\nSlackware -current packages:\n8eca7a113cf58688dc6203c4091fd0ac a/openssl-solibs-1.0.2k-i586-1.txz\n1ee03441f6409e48dda42c006ae5a7ad n/openssl-1.0.2k-i586-1.txz\n\nSlackware x86_64 -current packages:\n51ed87062d6898bd50705b2c2abc2c68 a/openssl-solibs-1.0.2k-x86_64-1.txz\nd9e56ff59fd7aa5791bf6809ccea0f92 n/openssl-1.0.2k-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the packages as root:\n# upgradepkg openssl-1.0.2k-i586-1_slack14.2.txz openssl-solibs-1.0.2k-i586-1_slack14.2.txz \n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list: |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message: |\n| |\n| unsubscribe slackware-security |\n| |\n| You will get a confirmation message back containing instructions to |\n| complete the process. Please do not reply to this email address. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201802-04\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: MySQL: Multiple vulnerabilities\n Date: February 20, 2018\n Bugs: #616486, #625626, #634652, #644986\n ID: 201802-04\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in MySQL, the worst of which may\nallow remote execution of arbitrary code. \n\nBackground\n==========\n\nA fast, multi-threaded, multi-user SQL database server. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 dev-db/mysql \u003c 5.6.39 \u003e= 5.6.39\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in MySQL. Please review\nthe referenced CVE identifiers for details. \n\nImpact\n======\n\nA remote attacker could execute arbitrary code without authentication\nor cause a partial denial of service condition. \n\nWorkaround\n==========\n\nThere are no known workarounds at this time. \n\nResolution\n==========\n\nAll MySQL users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-db/mysql-5.6.39\"\n\nReferences\n==========\n\n[ 1 ] CVE-2017-10155\n https://nvd.nist.gov/vuln/detail/CVE-2017-10155\n[ 2 ] CVE-2017-10227\n https://nvd.nist.gov/vuln/detail/CVE-2017-10227\n[ 3 ] CVE-2017-10268\n https://nvd.nist.gov/vuln/detail/CVE-2017-10268\n[ 4 ] CVE-2017-10276\n https://nvd.nist.gov/vuln/detail/CVE-2017-10276\n[ 5 ] CVE-2017-10283\n https://nvd.nist.gov/vuln/detail/CVE-2017-10283\n[ 6 ] CVE-2017-10286\n https://nvd.nist.gov/vuln/detail/CVE-2017-10286\n[ 7 ] CVE-2017-10294\n https://nvd.nist.gov/vuln/detail/CVE-2017-10294\n[ 8 ] CVE-2017-10314\n https://nvd.nist.gov/vuln/detail/CVE-2017-10314\n[ 9 ] CVE-2017-10378\n https://nvd.nist.gov/vuln/detail/CVE-2017-10378\n[ 10 ] CVE-2017-10379\n https://nvd.nist.gov/vuln/detail/CVE-2017-10379\n[ 11 ] CVE-2017-10384\n https://nvd.nist.gov/vuln/detail/CVE-2017-10384\n[ 12 ] CVE-2017-3308\n https://nvd.nist.gov/vuln/detail/CVE-2017-3308\n[ 13 ] CVE-2017-3309\n https://nvd.nist.gov/vuln/detail/CVE-2017-3309\n[ 14 ] CVE-2017-3329\n https://nvd.nist.gov/vuln/detail/CVE-2017-3329\n[ 15 ] CVE-2017-3450\n https://nvd.nist.gov/vuln/detail/CVE-2017-3450\n[ 16 ] CVE-2017-3452\n https://nvd.nist.gov/vuln/detail/CVE-2017-3452\n[ 17 ] CVE-2017-3453\n https://nvd.nist.gov/vuln/detail/CVE-2017-3453\n[ 18 ] CVE-2017-3456\n https://nvd.nist.gov/vuln/detail/CVE-2017-3456\n[ 19 ] CVE-2017-3461\n https://nvd.nist.gov/vuln/detail/CVE-2017-3461\n[ 20 ] CVE-2017-3462\n https://nvd.nist.gov/vuln/detail/CVE-2017-3462\n[ 21 ] CVE-2017-3463\n https://nvd.nist.gov/vuln/detail/CVE-2017-3463\n[ 22 ] CVE-2017-3464\n https://nvd.nist.gov/vuln/detail/CVE-2017-3464\n[ 23 ] CVE-2017-3599\n https://nvd.nist.gov/vuln/detail/CVE-2017-3599\n[ 24 ] CVE-2017-3600\n https://nvd.nist.gov/vuln/detail/CVE-2017-3600\n[ 25 ] CVE-2017-3633\n https://nvd.nist.gov/vuln/detail/CVE-2017-3633\n[ 26 ] CVE-2017-3634\n https://nvd.nist.gov/vuln/detail/CVE-2017-3634\n[ 27 ] CVE-2017-3635\n https://nvd.nist.gov/vuln/detail/CVE-2017-3635\n[ 28 ] CVE-2017-3636\n https://nvd.nist.gov/vuln/detail/CVE-2017-3636\n[ 29 ] CVE-2017-3637\n https://nvd.nist.gov/vuln/detail/CVE-2017-3637\n[ 30 ] CVE-2017-3641\n https://nvd.nist.gov/vuln/detail/CVE-2017-3641\n[ 31 ] CVE-2017-3647\n https://nvd.nist.gov/vuln/detail/CVE-2017-3647\n[ 32 ] CVE-2017-3648\n https://nvd.nist.gov/vuln/detail/CVE-2017-3648\n[ 33 ] CVE-2017-3649\n https://nvd.nist.gov/vuln/detail/CVE-2017-3649\n[ 34 ] CVE-2017-3651\n https://nvd.nist.gov/vuln/detail/CVE-2017-3651\n[ 35 ] CVE-2017-3652\n https://nvd.nist.gov/vuln/detail/CVE-2017-3652\n[ 36 ] CVE-2017-3653\n https://nvd.nist.gov/vuln/detail/CVE-2017-3653\n[ 37 ] CVE-2017-3732\n https://nvd.nist.gov/vuln/detail/CVE-2017-3732\n[ 38 ] CVE-2018-2562\n https://nvd.nist.gov/vuln/detail/CVE-2018-2562\n[ 39 ] CVE-2018-2573\n https://nvd.nist.gov/vuln/detail/CVE-2018-2573\n[ 40 ] CVE-2018-2583\n https://nvd.nist.gov/vuln/detail/CVE-2018-2583\n[ 41 ] CVE-2018-2590\n https://nvd.nist.gov/vuln/detail/CVE-2018-2590\n[ 42 ] CVE-2018-2591\n https://nvd.nist.gov/vuln/detail/CVE-2018-2591\n[ 43 ] CVE-2018-2612\n https://nvd.nist.gov/vuln/detail/CVE-2018-2612\n[ 44 ] CVE-2018-2622\n https://nvd.nist.gov/vuln/detail/CVE-2018-2622\n[ 45 ] CVE-2018-2640\n https://nvd.nist.gov/vuln/detail/CVE-2018-2640\n[ 46 ] CVE-2018-2645\n https://nvd.nist.gov/vuln/detail/CVE-2018-2645\n[ 47 ] CVE-2018-2647\n https://nvd.nist.gov/vuln/detail/CVE-2018-2647\n[ 48 ] CVE-2018-2665\n https://nvd.nist.gov/vuln/detail/CVE-2018-2665\n[ 49 ] CVE-2018-2668\n https://nvd.nist.gov/vuln/detail/CVE-2018-2668\n[ 50 ] CVE-2018-2696\n https://nvd.nist.gov/vuln/detail/CVE-2018-2696\n[ 51 ] CVE-2018-2703\n https://nvd.nist.gov/vuln/detail/CVE-2018-2703\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201802-04\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2018 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n\n. Description:\n\nThis release adds the new Apache HTTP Server 2.4.29 packages that are part\nof the JBoss Core Services offering. \n\nThis release serves as a replacement for Red Hat JBoss Core Services\nApache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer\nto the Release Notes for information on the most significant bug fixes,\nenhancements and component upgrades included in this release. \n\nThis release upgrades OpenSSL to version 1.0.2.n\n\nSecurity Fix(es):\n\n* openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()\n(CVE-2016-2182)\n\n* openssl: Insufficient TLS session ticket HMAC length checks\n(CVE-2016-6302)\n\n* openssl: certificate message OOB reads (CVE-2016-6306)\n\n* openssl: Carry propagating bug in Montgomery multiplication\n(CVE-2016-7055)\n\n* openssl: Truncated packet could crash via OOB read (CVE-2017-3731)\n\n* openssl: BN_mod_exp may produce incorrect results on x86_64\n(CVE-2017-3732)\n\n* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)\n\n* openssl: Read/write after SSL object in error state (CVE-2017-3737)\n\n* openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)\n\nRed Hat would like to thank the OpenSSL project for reporting CVE-2016-6306\nand CVE-2016-7055. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):\n\n1367340 - CVE-2016-2182 openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()\n1369855 - CVE-2016-6302 openssl: Insufficient TLS session ticket HMAC length checks\n1377594 - CVE-2016-6306 openssl: certificate message OOB reads\n1393929 - CVE-2016-7055 openssl: Carry propagating bug in Montgomery multiplication\n1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read\n1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64\n1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64\n1523504 - CVE-2017-3737 openssl: Read/write after SSL object in error state\n1523510 - CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64\n\n6. JIRA issues fixed (https://issues.jboss.org/):\n\nJBCS-373 - Errata for httpd 2.4.29 GA RHEL 7\n\n7. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Important: java-1.8.0-ibm security update\nAdvisory ID: RHSA-2018:2575-01\nProduct: Red Hat Enterprise Linux Supplementary\nAdvisory URL: https://access.redhat.com/errata/RHSA-2018:2575\nIssue date: 2018-08-28\nCVE Names: CVE-2016-0705 CVE-2017-3732 CVE-2017-3736\n CVE-2018-1517 CVE-2018-1656 CVE-2018-2940\n CVE-2018-2952 CVE-2018-2973 CVE-2018-12539\n====================================================================\n1. Summary:\n\nAn update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux\n6 Supplementary. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64\nRed Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64\nRed Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64\n\n3. Description:\n\nIBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit. \n\nThis update upgrades IBM Java SE 8 to version 8 SR5-FP20. \n\nSecurity Fix(es):\n\n* IBM JDK: privilege escalation via insufficiently restricted access to\nAttach API (CVE-2018-12539)\n\n* openssl: BN_mod_exp may produce incorrect results on x86_64\n(CVE-2017-3732)\n\n* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)\n\n* IBM JDK: DoS in the java.math component (CVE-2018-1517)\n\n* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework\n(CVE-2018-1656)\n\n* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and\n10.0.2 (Libraries) (CVE-2018-2940)\n\n* OpenJDK: insufficient index validation in PatternSyntaxException\ngetMessage() (Concurrency, 8199547) (CVE-2018-2952)\n\n* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and\n10.0.2 (JSSE) (CVE-2018-2973)\n\n* OpenSSL: Double-free in DSA code (CVE-2016-0705)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\nRed Hat would like to thank the OpenSSL project for reporting\nCVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the\noriginal reporter of CVE-2016-0705. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take\neffect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1310596 - CVE-2016-0705 OpenSSL: Double-free in DSA code\n1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64\n1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64\n1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)\n1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)\n1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries)\n1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API\n1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework\n1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop Supplementary (v. 6):\n\ni386:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm\n\nx86_64:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node Supplementary (v. 6):\n\nx86_64:\njava-1.8.0-ibm-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Server Supplementary (v. 6):\n\ni386:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm\n\nppc64:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.ppc64.rpm\n\ns390x:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.s390x.rpm\n\nx86_64:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Supplementary (v. 6):\n\ni386:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm\n\nx86_64:\njava-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-0705\nhttps://access.redhat.com/security/cve/CVE-2017-3732\nhttps://access.redhat.com/security/cve/CVE-2017-3736\nhttps://access.redhat.com/security/cve/CVE-2018-1517\nhttps://access.redhat.com/security/cve/CVE-2018-1656\nhttps://access.redhat.com/security/cve/CVE-2018-2940\nhttps://access.redhat.com/security/cve/CVE-2018-2952\nhttps://access.redhat.com/security/cve/CVE-2018-2973\nhttps://access.redhat.com/security/cve/CVE-2018-12539\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBW4WgLdzjgjWX9erEAQixyw//d2pemlb2TNR2kW3WlrxY0KBjUBM+PS4i\nbQ8+SoNsct2XtVFq0oOfwAmYMn++pAY37yvvhUdefe5sAcUldDcJtLIgXbtISSXe\nV5EdrLvQbv/rSxikOfccFzNI8GwJTgGiLpq8n9exHcSsY5cZevzukgRr6b+yQbnj\nmcYEC3TB/CnulDac/Pt0VsS9AoFhwuX958/+EQdpMq1yOGqog6eM8U6x2btA4YSi\nmcVD2hom6GuYMKq0oWDPWPry5hJePvbPM6GZw8pYdRvA1eKjp24M3mkWkkIEFw6U\naZCW6YXJuwMMJ4IYbF1Aofm3ab+R1VZXmPvzMHXRhVcRyZLvBzo1fZaw7ISX1ibV\nFimDRrXLIJDudoS80DMVmbgQTL37U6pGAe6gV2JLtvtEZl02Sxq5PeRfuMME4qeP\nrT+xyz0zjyIqTpxhAzAQJ28ZCrWDvRycCT5ZLwaPfxZ0+4cY1l58TMfYpdwIKJSC\nM8HQccrNxQ8S/kSKexIT18mSQcMwOhDza6gV4hSiOQgI/xHW3sic78a7/74JnSBT\nDgZuicAq73IWdYu67B04UzsZNsySSW6vs3BeYdfN5BnmK40NxrH5d5LMRV4xKmN+\nHlkzX1CrDCBl9PtbQF0xpUGluvXCg1u2kzGHj4Dv7JP64bV1wXmLm5kwrPL/QZhv\n8IL8kIZinC8=eoiE\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-3732"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
},
{
"db": "VULMON",
"id": "CVE-2017-3732"
},
{
"db": "PACKETSTORM",
"id": "169631"
},
{
"db": "PACKETSTORM",
"id": "148521"
},
{
"db": "PACKETSTORM",
"id": "148525"
},
{
"db": "PACKETSTORM",
"id": "141025"
},
{
"db": "PACKETSTORM",
"id": "146486"
},
{
"db": "PACKETSTORM",
"id": "149403"
},
{
"db": "PACKETSTORM",
"id": "148524"
},
{
"db": "PACKETSTORM",
"id": "149130"
}
],
"trust": 2.43
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2017-3732",
"trust": 3.3
},
{
"db": "SECTRACK",
"id": "1037717",
"trust": 1.7
},
{
"db": "BID",
"id": "95814",
"trust": 1.7
},
{
"db": "TENABLE",
"id": "TNS-2017-04",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU92830136",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2022.0696",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.1415",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.4325",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.0258.3",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.1613",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.0733",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201702-216",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2017-3732",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "169631",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "148521",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "148525",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "141025",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146486",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "149403",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "148524",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "149130",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-3732"
},
{
"db": "PACKETSTORM",
"id": "169631"
},
{
"db": "PACKETSTORM",
"id": "148521"
},
{
"db": "PACKETSTORM",
"id": "148525"
},
{
"db": "PACKETSTORM",
"id": "141025"
},
{
"db": "PACKETSTORM",
"id": "146486"
},
{
"db": "PACKETSTORM",
"id": "149403"
},
{
"db": "PACKETSTORM",
"id": "148524"
},
{
"db": "PACKETSTORM",
"id": "149130"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
},
{
"db": "NVD",
"id": "CVE-2017-3732"
}
]
},
"id": "VAR-201705-3649",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.206875005
},
"last_update_date": "2026-03-09T20:09:59.018000Z",
"patch": {
"_id": null,
"data": [
{
"title": "hitachi-sec-2018-103",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2018-103/index.html"
},
{
"title": "hitachi-sec-2017-115",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-115/index.html"
},
{
"title": "NV17-011",
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv17-011.html"
},
{
"title": "BN_mod_exp may produce incorrect results on x86_64",
"trust": 0.8,
"url": "https://www.openssl.org/news/secadv/20170126.txt"
},
{
"title": "hitachi-sec-2018-103",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2018-103/index.html"
},
{
"title": "hitachi-sec-2017-115",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-115/index.html"
},
{
"title": "OpenSSL Repair measures for information disclosure vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67520"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2017/01/31/openssl_patches/"
},
{
"title": "Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182185 - Security Advisory"
},
{
"title": "Red Hat: Important: java-1.8.0-ibm security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182575 - Security Advisory"
},
{
"title": "Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182186 - Security Advisory"
},
{
"title": "Red Hat: Moderate: java-1.8.0-ibm security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182713 - Security Advisory"
},
{
"title": "Red Hat: Important: java-1.8.0-ibm security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182568 - Security Advisory"
},
{
"title": "Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182187 - Security Advisory"
},
{
"title": "Red Hat: CVE-2017-3732",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2017-3732"
},
{
"title": "Arch Linux Issues: ",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2017-3732"
},
{
"title": "IBM: Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=030cb7ac9266aec85453c1d2339fbc00"
},
{
"title": "Ubuntu Security Notice: openssl vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3181-1"
},
{
"title": "Arch Linux Advisories: [ASA-201701-37] openssl: multiple issues",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201701-37"
},
{
"title": "Huawei Security Advisories: Security Advisory - Three OpenSSL Vulnerabilities in Huawei Products",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=huawei_security_advisories\u0026qid=1181e052a6a83786d4182d45ddb56d5d"
},
{
"title": "Symantec Security Advisories: SA141 : OpenSSL Vulnerabilities 26-Jan-2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=117bc0d26e74d755d85acf15af842eaf"
},
{
"title": "Arch Linux Advisories: [ASA-201701-36] lib32-openssl: multiple issues",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201701-36"
},
{
"title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2016-0705, CVE-2017-3732, CVE-2017-3736, CVE-2018-1656, CVE-2018-12539)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3d9ab13c871ea2142681c7977b25c5ff"
},
{
"title": "IBM: IBM Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU \u2013 Jul 2018 \u2013 Includes Oracle Jul 2018 CPU affects DB2 Recovery Expert for Linux, Unix and Windows",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=af4ddb95056d65a4af347aec0f652f0e"
},
{
"title": "Cisco: Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: January and February 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-20170130-openssl"
},
{
"title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Planning",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=62ef85c9034c17315b7d0a712483c5ea"
},
{
"title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Reporting for Development Intelligence",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=03b0267d78cd8ac1bbb43afc737474f0"
},
{
"title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Information Server",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=63bbfc68418161b36080acd59a541d45"
},
{
"title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Privileged Identity Manager",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=42a34f9348fc5f34065c6d25764eb2a2"
},
{
"title": "Debian CVElist Bug Report Logs: Security fixes from the July 2017 CPU",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=adc1e0c986afd5f2f3b0797ba936d072"
},
{
"title": "IBM: IBM Security Bulletin: IBM Cognos Controller 2019Q2 Security Updater: Multiple vulnerabilities have been identified in IBM Cognos Controller",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=38227211accce022b0a3d9b56a974186"
},
{
"title": "Forcepoint Security Advisories: CVE-2017-3730, -3731, -3732 OpenSSL Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=forcepoint_security_advisories\u0026qid=16a227df38f44014c9520f3b6cb5344e"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a2bac27fb002bed513645d4775c7275b"
},
{
"title": "Tenable Security Advisories: [R5] SecurityCenter 5.4.3 Fixes Multiple Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories\u0026qid=TNS-2017-04"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a31bff03e9909229fd67996884614fdf"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - July 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=2f446a7e1ea263c0c3a365776c6713f2"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - July 2018",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=5f8c525f1408011628af1792207b2099"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2018",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=586e6062440cdd312211d748e028164e"
},
{
"title": "IBM: IBM Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=dd8c9d5928cc3b1ac8c35b4b24703e38"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - April 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=143b3fb255063c81571469eaa3cf0a87"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - October 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=523d3f220a64ff01dd95e064bd37566a"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - January 2018",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=e2a7f287e9acc8c64ab3df71130bc64d"
},
{
"title": "IBM: Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics for NPS",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=c36fc403a4c2c6439b732d2fca738f58"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2018",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=525e4e31765e47b9e53b24e880af9d6e"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - October 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=6283337cd31f81f24d445925f2138c0e"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-3732"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
},
{
"db": "NVD",
"id": "CVE-2017-3732"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/95814"
},
{
"trust": 1.8,
"url": "https://www.openssl.org/news/secadv/20170126.txt"
},
{
"trust": 1.8,
"url": "https://access.redhat.com/errata/rhsa-2018:2187"
},
{
"trust": 1.8,
"url": "https://access.redhat.com/errata/rhsa-2018:2186"
},
{
"trust": 1.8,
"url": "https://access.redhat.com/errata/rhsa-2018:2185"
},
{
"trust": 1.8,
"url": "https://access.redhat.com/errata/rhsa-2018:2575"
},
{
"trust": 1.8,
"url": "https://access.redhat.com/errata/rhsa-2018:2713"
},
{
"trust": 1.7,
"url": "https://security.gentoo.org/glsa/201702-07"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id/1037717"
},
{
"trust": 1.7,
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"trust": 1.7,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"trust": 1.7,
"url": "https://www.tenable.com/security/tns-2017-04"
},
{
"trust": 1.7,
"url": "https://security.freebsd.org/advisories/freebsd-sa-17:02.openssl.asc"
},
{
"trust": 1.7,
"url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
},
{
"trust": 1.7,
"url": "https://github.com/openssl/openssl/commit/a59b90bf491410f1f2bc4540cc21f1980fd14c5b"
},
{
"trust": 1.7,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03838en_us"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2018:2568"
},
{
"trust": 1.7,
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3732"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3732"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu92830136/"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3736"
},
{
"trust": 0.6,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10715641"
},
{
"trust": 0.6,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10871356"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0696"
},
{
"trust": 0.6,
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10882734"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/76710"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.4325/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics-for-nps/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-jre-8-0-1-1-affect-ibm-netezza-platform-software-clients/"
},
{
"trust": 0.6,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10882292"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/80494"
},
{
"trust": 0.6,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10882754"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/79678"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/support/pages/node/1106811"
},
{
"trust": 0.6,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10734877"
},
{
"trust": 0.6,
"url": "https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170503-01-openssl-cn"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/74714"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.5,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2017-3732"
},
{
"trust": 0.5,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2017-3736"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3731"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-7055"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-2182"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-6302"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3738"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-3731"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-3737"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2016-6306"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-3738"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-6306"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.29/"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2016-2182"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2016-7055"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3737"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2016-6302"
},
{
"trust": 0.2,
"url": "https://issues.jboss.org/):"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2940"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-2952"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-12539"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0705"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2016-0705"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-2973"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-1656"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-2940"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-1517"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1517"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2952"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1656"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2973"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12539"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://tools.cisco.com/security/center/viewalert.x?alertid=52438"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/3181-1/"
},
{
"trust": 0.1,
"url": "https://www.openssl.org/news/secadv/20170828.txt,"
},
{
"trust": 0.1,
"url": "https://www.openssl.org/policies/secpolicy.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3735"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3193"
},
{
"trust": 0.1,
"url": "https://www.openssl.org/news/secadv/20171102.txt"
},
{
"trust": 0.1,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7055"
},
{
"trust": 0.1,
"url": "http://slackware.com"
},
{
"trust": 0.1,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3731"
},
{
"trust": 0.1,
"url": "http://osuosl.org)"
},
{
"trust": 0.1,
"url": "http://slackware.com/gpg-key"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2645"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3653"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10227"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3635"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3637"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3634"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3648"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2591"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2668"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3456"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3652"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10379"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10314"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10268"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3452"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2622"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/glsa/201802-04"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3329"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2590"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3649"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3450"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10283"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10286"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2647"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10294"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3651"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3647"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3462"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2583"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3309"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2612"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2703"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3308"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2640"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3636"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3461"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10276"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2696"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10378"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10384"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2562"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2665"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3453"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-2573"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3464"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3633"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3599"
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10155"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3641"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3600"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3463"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#important"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-3732"
},
{
"db": "PACKETSTORM",
"id": "169631"
},
{
"db": "PACKETSTORM",
"id": "148521"
},
{
"db": "PACKETSTORM",
"id": "148525"
},
{
"db": "PACKETSTORM",
"id": "141025"
},
{
"db": "PACKETSTORM",
"id": "146486"
},
{
"db": "PACKETSTORM",
"id": "149403"
},
{
"db": "PACKETSTORM",
"id": "148524"
},
{
"db": "PACKETSTORM",
"id": "149130"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
},
{
"db": "NVD",
"id": "CVE-2017-3732"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "VULMON",
"id": "CVE-2017-3732",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "169631",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "148521",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "148525",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "141025",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "146486",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "149403",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "148524",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "149130",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201702-216",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003156",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2017-3732",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2017-05-04T00:00:00",
"db": "VULMON",
"id": "CVE-2017-3732",
"ident": null
},
{
"date": "2017-11-02T12:12:12",
"db": "PACKETSTORM",
"id": "169631",
"ident": null
},
{
"date": "2018-07-12T21:45:18",
"db": "PACKETSTORM",
"id": "148521",
"ident": null
},
{
"date": "2018-07-12T21:48:57",
"db": "PACKETSTORM",
"id": "148525",
"ident": null
},
{
"date": "2017-02-13T16:38:20",
"db": "PACKETSTORM",
"id": "141025",
"ident": null
},
{
"date": "2018-02-20T14:04:53",
"db": "PACKETSTORM",
"id": "146486",
"ident": null
},
{
"date": "2018-09-18T02:18:55",
"db": "PACKETSTORM",
"id": "149403",
"ident": null
},
{
"date": "2018-07-12T21:48:49",
"db": "PACKETSTORM",
"id": "148524",
"ident": null
},
{
"date": "2018-08-29T00:28:49",
"db": "PACKETSTORM",
"id": "149130",
"ident": null
},
{
"date": "2017-01-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201702-216",
"ident": null
},
{
"date": "2017-05-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-003156",
"ident": null
},
{
"date": "2017-05-04T19:29:00.400000",
"db": "NVD",
"id": "CVE-2017-3732",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2022-08-29T00:00:00",
"db": "VULMON",
"id": "CVE-2017-3732",
"ident": null
},
{
"date": "2022-08-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201702-216",
"ident": null
},
{
"date": "2018-02-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-003156",
"ident": null
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-3732",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "148525"
},
{
"db": "PACKETSTORM",
"id": "146486"
},
{
"db": "PACKETSTORM",
"id": "148524"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
}
],
"trust": 0.9
},
"title": {
"_id": null,
"data": "OpenSSL Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003156"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201702-216"
}
],
"trust": 0.6
}
}
VAR-201706-0272
Vulnerability from variot - Updated: 2026-03-05 22:54In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Apache httpd Contains an authentication vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Apache HTTP Server is prone to an authentication bypass vulnerability. An attacker can exploit this issue to bypass authentication mechanism and perform unauthorized actions. This may lead to further attacks. The following versions are vulnerable: Apache HTTP Server 2.2.0 to 2.2.32 Apache HTTP Server 2.4.0 to 2.4.25. Advisory ID: SYSS-2024-029 Product: C-MOR Video Surveillance Manufacturer: za-internet GmbH Affected Version(s): 5.2401 Tested Version(s): 5.2401 Vulnerability Type: Dependency on Vulnerable Third-Party Component (CWE-1395) Use of Unmaintained Third Party Components (CWE-1104) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2024-04-05 Solution Date: 2024-07-31 Public Disclosure: 2024-09-04 CVE Reference: CVE-2017-9798, CVE-2017-3167, and more Authors of Advisory: Chris Beiter, Frederik Beimgraben, and Matthias Deeg
Overview:
The software product C-MOR is an IP video surveillance system.
The manufacturer describes the product as follows:
"With C-MOR video surveillance, it is possible to check your
surveillance over network and the Internet. You can access the live
view as well as previous recordings from any PC or mobile device.
C-MOR is managed and controlled over the C-MOR web interface.
IP settings, camera recording setup, user rights and so on are set
over the web without the installation of any software on the
client."[1]
The C-MOR system uses several outdated third-party software components
with known security vulnerabilities.
Vulnerability Details:
By analyzing the C-MOR system, it was found that the C-MOR system depends on several outdated third-party software components with known security vulnerabilities, for instance an old Linux kernel, Apache HTTP Server 2.2.16, PHP 5.3.3, or Python 2.6.
Some of the used software components have also reached their end of life and are not supported anymore by a maintainer.
Proof of Concept (PoC):
The following excerpt of the "dpkg-query" output illustrates some outdated
third-party software components used on the C-MOR system:
$ sudo dpkg-query -l
(...)
ii apache2 2.2.16-6+squeeze10
Apache HTTP Server metapackage
ii apache2-mpm-prefork 2.2.16-6+squeeze10
Apache HTTP Server - traditional non-threaded model
ii apache2-utils 2.2.16-6+squeeze10
utility programs for webservers
ii apache2.2-bin 2.2.16-6+squeeze10
Apache HTTP Server common binary files
ii apache2.2-common 2.2.16-6+squeeze10
Apache HTTP Server common files
(...)
ii libapache2-mod-php5 5.3.3-7+squeeze14
server-side, HTML-embedded scripting language (Apache 2 module)
(...)
ii libssl0.9.8 0.9.8o-4squeeze14 SSL
shared libraries
(...)
ii linux-image-4.7.8 c-mor-v5-00
Linux kernel binary image for version 4.7.8
(...)
ii php5 5.3.3-7+squeeze14
server-side, HTML-embedded scripting language (metapackage)
rc php5-cgi 5.3.3-7+squeeze14
server-side, HTML-embedded scripting language (CGI binary)
ii php5-cli 5.3.3-7+squeeze14
command-line interpreter for the php5 scripting language
ii php5-common 5.3.3-7+squeeze14
Common files for packages built from the php5 source
ii php5-gd 5.3.3-7+squeeze14 GD
module for php5
ii php5-mysql 5.3.3-7+squeeze14
MySQL module for php5
ii php5-suhosin 0.9.32.1-1
advanced protection module for php5
(...)
ii python2.6 2.6.6-8+b1 An
interactive high-level object-oriented language (version 2.6)
ii python2.6-minimal 2.6.6-8+b1 A
minimal subset of the Python language (version 2.6)
(...)
Solution:
Install C-MOR Video Surveillance version 6.00PL1.
Disclosure Timeline:
2024-04-05: Vulnerability reported to manufacturer
2024-04-05: Manufacturer acknowledges receipt of security advisories
2024-04-08: Exchange regarding security updates and disclosure timeline
2024-05-08: Further exchange concerning security updates and disclosure
timeline; public release of all security advisories
scheduled for release of C-MOR Video Surveillance version 6
2024-05-10: Release of C-MOR software version 5.30 with security updates
for some reported security issues
2024-07-19: E-mail to manufacturer concerning release date of C-MOR
Video Surveillance version 6; response with planned
release date of 2024-08-01
2024-07-30: E-mail from manufacturer with further information
concerning security fixes
2024-07-31: Release of C-MOR software version 6.00PL1
2024-09-04: Public release of security advisory
References:
[1] Product website for C-MOR Video Surveillance https://www.c-mor.com/ [2] SySS Security Advisory SYSS-2024-029
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-029.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/
Credits:
This security vulnerability was found by Chris Beiter, and Frederik
Beimgraben.
Disclaimer:
The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en
.
Mitigation: 2.2.x users should either apply the patch available at https://www.apache.org/dist/httpd/patches/apply_to_2.2.32/CVE-2017-3167.patch or upgrade in the future to 2.2.33, which is currently unreleased.
2.4.x users should upgrade to 2.4.26.
Third-party module writers SHOULD use ap_get_basic_auth_components(), available in 2.2.33 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the legacy ap_get_basic_auth_pw() during the authentication phase MUST either immediately authenticate the user after the call, or else stop the request immediately with an error response, to avoid incorrectly authenticating the current request.
Credit: The Apache HTTP Server security team would like to thank Emmanuel Dreyfus for reporting this issue. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Important: httpd24-httpd security update Advisory ID: RHSA-2017:2483-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2017:2483 Issue date: 2017-08-16 CVE Names: CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 =====================================================================
- Summary:
An update for httpd24-httpd is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
Security Fix(es):
-
It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-3167)
-
A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169)
-
A NULL pointer dereference flaw was found in the mod_http2 module of httpd. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP/2 request. (CVE-2017-7659)
-
A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668)
-
A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)
-
Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted automatically.
- Bugs fixed (https://bugzilla.redhat.com/):
1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass 1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference 1463199 - CVE-2017-7659 httpd: mod_http2 NULL pointer dereference 1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread 1463207 - CVE-2017-7679 httpd: mod_mime buffer overread 1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest
- Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):
Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source: httpd24-httpd-2.4.25-9.el6.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):
Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source: httpd24-httpd-2.4.25-9.el7.1.src.rpm
noarch: httpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm
x86_64: httpd24-httpd-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm httpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm httpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2017-3167 https://access.redhat.com/security/cve/CVE-2017-3169 https://access.redhat.com/security/cve/CVE-2017-7659 https://access.redhat.com/security/cve/CVE-2017-7668 https://access.redhat.com/security/cve/CVE-2017-7679 https://access.redhat.com/security/cve/CVE-2017-9788 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iD8DBQFZlNCpXlSAg2UNWIIRArzwAJwNfAuroR6X18rUh+zmjiMy5iBkdwCeJF6e 4v4GwWYC+5xG0xxXzTEQyAg= =UV+2 -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . (CVE-2017-7679)
- A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. (CVE-2017-9798)
Red Hat would like to thank Hanno BAPck for reporting CVE-2017-9798. 6) - i386, noarch, x86_64
3
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "8.0"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "enterprise linux server aus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.4"
},
{
"_id": null,
"model": "oncommand unified manager",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "enterprise linux server tus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.3"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.0"
},
{
"_id": null,
"model": "enterprise linux server aus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.2"
},
{
"_id": null,
"model": "http server",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.2.33"
},
{
"_id": null,
"model": "http server",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.2.0"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.3"
},
{
"_id": null,
"model": "storagegrid",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.7"
},
{
"_id": null,
"model": "enterprise linux server aus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.7"
},
{
"_id": null,
"model": "enterprise linux server aus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.6"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.0"
},
{
"_id": null,
"model": "enterprise linux server tus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.4"
},
{
"_id": null,
"model": "jboss core services",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "1.0"
},
{
"_id": null,
"model": "enterprise linux server tus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.2"
},
{
"_id": null,
"model": "clustered data ontap",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"_id": null,
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.4"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.5"
},
{
"_id": null,
"model": "enterprise linux server aus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.3"
},
{
"_id": null,
"model": "enterprise linux server tus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.7"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.2"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"_id": null,
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.13.1"
},
{
"_id": null,
"model": "http server",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.4.26"
},
{
"_id": null,
"model": "enterprise linux server tus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.6"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.7"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"_id": null,
"model": "secure global desktop",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "5.3"
},
{
"_id": null,
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.0"
},
{
"_id": null,
"model": "enterprise linux eus",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.6"
},
{
"_id": null,
"model": "http server",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.4.0"
},
{
"_id": null,
"model": "jp1/automatic job management system 3",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager web console"
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support starter edition"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - operations director"
},
{
"_id": null,
"model": "web server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- custom edition"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "(64)"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "express"
},
{
"_id": null,
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"_id": null,
"model": "web server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "professional for plug-in"
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- messaging"
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
},
{
"_id": null,
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- web console"
},
{
"_id": null,
"model": "ucosminexus developer standard",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "(64)"
},
{
"_id": null,
"model": "httpd",
"scope": "eq",
"trust": 0.8,
"vendor": "apache",
"version": "2.4.26"
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"_id": null,
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/automatic operation",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "01"
},
{
"_id": null,
"model": "job management partner 1/performance management - web console",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"_id": null,
"model": "ucosminexus developer light",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"_id": null,
"model": "application server for developers",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"_id": null,
"model": "ucosminexus primary server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "base"
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "st ard-r"
},
{
"_id": null,
"model": "ucosminexus primary server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "base(64)"
},
{
"_id": null,
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
},
{
"_id": null,
"model": "ucosminexus service platform",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "httpd",
"scope": "eq",
"trust": 0.8,
"vendor": "apache",
"version": "2.2.33"
},
{
"_id": null,
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/service support",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "jp1/operations analytics",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/service support",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "starter edition"
},
{
"_id": null,
"model": "cosminexus http server",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus application server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "-r"
},
{
"_id": null,
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"_id": null,
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus service architect",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "ucosminexus application server enterprise",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager web console"
},
{
"_id": null,
"model": "spoolserver/winspool series",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "reportfiling ver5.2 ~ 6.2"
},
{
"_id": null,
"model": "ucosminexus application server standard",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "web server",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- security edition"
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "professional"
},
{
"_id": null,
"model": "httpd",
"scope": "lt",
"trust": 0.8,
"vendor": "apache",
"version": "2.2.x"
},
{
"_id": null,
"model": "ucosminexus developer",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "none"
},
{
"_id": null,
"model": "ucosminexus application server smart edition",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "application server",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": "httpd",
"scope": "lt",
"trust": 0.8,
"vendor": "apache",
"version": "2.4.x"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.0"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.31"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.30"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.24"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.25"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.29"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.22"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.23"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.26"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.2.27"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "17.04"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "16.10"
},
{
"_id": null,
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "16.04"
},
{
"_id": null,
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "14.04"
},
{
"_id": null,
"model": "software collections for rhel",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "0"
},
{
"_id": null,
"model": "jboss web server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "0"
},
{
"_id": null,
"model": "jboss ews",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "2"
},
{
"_id": null,
"model": "jboss eap",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "jboss core services",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "1"
},
{
"_id": null,
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5.0"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"_id": null,
"model": "i",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.1"
},
{
"_id": null,
"model": "i",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.3"
},
{
"_id": null,
"model": "i",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.52"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.52"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.09"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.033"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.029"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.11"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.4"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.3"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.2"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.9"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.8"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.7"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.6"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.4"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.3"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.11"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.10"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.0.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.7"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.6"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.4"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.3"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.2"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.13"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.12"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.11"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.1"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.4.27"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.5"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.43"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.39"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.27"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.25"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.21"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.19"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.17"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.15"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.13"
},
{
"_id": null,
"model": "http server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0"
},
{
"_id": null,
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"_id": null,
"model": "centos",
"scope": "eq",
"trust": 0.3,
"vendor": "centos",
"version": "6"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.25"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.20"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.19"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.18"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.17"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.16"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.14"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.12"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.11"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.10"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.4"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.26"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.25"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.24"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.23"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.15"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.14"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.13"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.12"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.11"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.10"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.3"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.2"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.3"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.24"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.2"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.13"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.1"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.0"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.32"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.29"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.22"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.21"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.20"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.19"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.18"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.17"
},
{
"_id": null,
"model": "apache",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.2.1"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0.0.5"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.5.12"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.0.14"
},
{
"_id": null,
"model": "http server",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0.0.45"
},
{
"_id": null,
"model": "apache",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "2.4.26"
},
{
"_id": null,
"model": "2.2.33-dev",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "99135"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
},
{
"db": "NVD",
"id": "CVE-2017-3167"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apache:httpd",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:spoolserver_winspool",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:cosminexus_http_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:hitachi_application_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:hitachi_application_server_for_developers",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:hitachi_web_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_performance_management_web_console",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_job_management_system_3",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_operation",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_operation_analytics",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_performance_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_service_support",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server_enterprise",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server_smart_edition",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server_standard",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer_light",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer_standard",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_primary_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_architect",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_platform",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
}
]
},
"credits": {
"_id": null,
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "143766"
},
{
"db": "PACKETSTORM",
"id": "144968"
},
{
"db": "PACKETSTORM",
"id": "144969"
}
],
"trust": 0.5
},
"cve": "CVE-2017-3167",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2017-3167",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-3167",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-3167",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-3167",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-3167",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-789",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2017-3167",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-3167"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
},
{
"db": "NVD",
"id": "CVE-2017-3167"
}
]
},
"description": {
"_id": null,
"data": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Apache httpd Contains an authentication vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Apache HTTP Server is prone to an authentication bypass vulnerability. \nAn attacker can exploit this issue to bypass authentication mechanism and perform unauthorized actions. This may lead to further attacks. \nThe following versions are vulnerable:\nApache HTTP Server 2.2.0 to 2.2.32\nApache HTTP Server 2.4.0 to 2.4.25. Advisory ID: SYSS-2024-029\nProduct: C-MOR Video Surveillance\nManufacturer: za-internet GmbH\nAffected Version(s): 5.2401\nTested Version(s): 5.2401\nVulnerability Type: Dependency on Vulnerable Third-Party \nComponent (CWE-1395)\n Use of Unmaintained Third Party Components \n(CWE-1104)\nRisk Level: High\nSolution Status: Fixed\nManufacturer Notification: 2024-04-05\nSolution Date: 2024-07-31\nPublic Disclosure: 2024-09-04\nCVE Reference: CVE-2017-9798, CVE-2017-3167, and more\nAuthors of Advisory: Chris Beiter, Frederik Beimgraben,\n and Matthias Deeg\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nThe software product C-MOR is an IP video surveillance system. \n\nThe manufacturer describes the product as follows:\n\n\"With C-MOR video surveillance, it is possible to check your\nsurveillance over network and the Internet. You can access the live\nview as well as previous recordings from any PC or mobile device. \nC-MOR is managed and controlled over the C-MOR web interface. \nIP settings, camera recording setup, user rights and so on are set\nover the web without the installation of any software on the\nclient.\"[1]\n\nThe C-MOR system uses several outdated third-party software components\nwith known security vulnerabilities. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nBy analyzing the C-MOR system, it was found that the C-MOR system depends\non several outdated third-party software components with known security\nvulnerabilities, for instance an old Linux kernel, Apache HTTP Server\n2.2.16, PHP 5.3.3, or Python 2.6. \n\nSome of the used software components have also reached their end of life\nand are not supported anymore by a maintainer. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following excerpt of the \"dpkg-query\" output illustrates some outdated\nthird-party software components used on the C-MOR system:\n\n$ sudo dpkg-query -l\n(...)\nii apache2 2.2.16-6+squeeze10 \nApache HTTP Server metapackage\nii apache2-mpm-prefork 2.2.16-6+squeeze10 \nApache HTTP Server - traditional non-threaded model\nii apache2-utils 2.2.16-6+squeeze10 \nutility programs for webservers\nii apache2.2-bin 2.2.16-6+squeeze10 \nApache HTTP Server common binary files\nii apache2.2-common 2.2.16-6+squeeze10 \nApache HTTP Server common files\n(...)\nii libapache2-mod-php5 5.3.3-7+squeeze14 \nserver-side, HTML-embedded scripting language (Apache 2 module)\n(...)\nii libssl0.9.8 0.9.8o-4squeeze14 SSL \nshared libraries\n(...)\nii linux-image-4.7.8 c-mor-v5-00 \nLinux kernel binary image for version 4.7.8\n(...)\nii php5 5.3.3-7+squeeze14 \nserver-side, HTML-embedded scripting language (metapackage)\nrc php5-cgi 5.3.3-7+squeeze14 \nserver-side, HTML-embedded scripting language (CGI binary)\nii php5-cli 5.3.3-7+squeeze14 \ncommand-line interpreter for the php5 scripting language\nii php5-common 5.3.3-7+squeeze14 \nCommon files for packages built from the php5 source\nii php5-gd 5.3.3-7+squeeze14 GD \nmodule for php5\nii php5-mysql 5.3.3-7+squeeze14 \nMySQL module for php5\nii php5-suhosin 0.9.32.1-1 \nadvanced protection module for php5\n(...)\nii python2.6 2.6.6-8+b1 An \ninteractive high-level object-oriented language (version 2.6)\nii python2.6-minimal 2.6.6-8+b1 A \nminimal subset of the Python language (version 2.6)\n(...)\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nInstall C-MOR Video Surveillance version 6.00PL1. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2024-04-05: Vulnerability reported to manufacturer\n2024-04-05: Manufacturer acknowledges receipt of security advisories\n2024-04-08: Exchange regarding security updates and disclosure timeline\n2024-05-08: Further exchange concerning security updates and disclosure\n timeline; public release of all security advisories\n scheduled for release of C-MOR Video Surveillance version 6\n2024-05-10: Release of C-MOR software version 5.30 with security updates\n for some reported security issues\n2024-07-19: E-mail to manufacturer concerning release date of C-MOR\n Video Surveillance version 6; response with planned\n release date of 2024-08-01\n2024-07-30: E-mail from manufacturer with further information\n concerning security fixes\n2024-07-31: Release of C-MOR software version 6.00PL1\n2024-09-04: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for C-MOR Video Surveillance\n https://www.c-mor.com/\n[2] SySS Security Advisory SYSS-2024-029\n \nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-029.txt\n[3] SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy/\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Chris Beiter, and Frederik\nBeimgraben. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS Web\nsite. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: http://creativecommons.org/licenses/by/3.0/deed.en\n\n. \n\nMitigation:\n2.2.x users should either apply the patch available at\nhttps://www.apache.org/dist/httpd/patches/apply_to_2.2.32/CVE-2017-3167.patch\nor upgrade in the future to 2.2.33, which is currently unreleased. \n\n2.4.x users should upgrade to 2.4.26. \n\nThird-party module writers SHOULD use ap_get_basic_auth_components(),\navailable in 2.2.33 and 2.4.26, instead of ap_get_basic_auth_pw(). \nModules which call the legacy ap_get_basic_auth_pw() during the\nauthentication phase MUST either immediately authenticate the user after\nthe call, or else stop the request immediately with an error response,\nto avoid incorrectly authenticating the current request. \n\nCredit:\nThe Apache HTTP Server security team would like to thank Emmanuel\nDreyfus for reporting this issue. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: httpd24-httpd security update\nAdvisory ID: RHSA-2017:2483-01\nProduct: Red Hat Software Collections\nAdvisory URL: https://access.redhat.com/errata/RHSA-2017:2483\nIssue date: 2017-08-16\nCVE Names: CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 \n CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 \n=====================================================================\n\n1. Summary:\n\nAn update for httpd24-httpd is now available for Red Hat Software\nCollections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64\n\n3. \n\nSecurity Fix(es):\n\n* It was discovered that the httpd\u0027s mod_auth_digest module did not\nproperly initialize memory before using it when processing certain headers\nrelated to digest authentication. A remote attacker could possibly use this\nflaw to disclose potentially sensitive information or cause httpd child\nprocess to crash by sending specially crafted requests to a server. (CVE-2017-3167)\n\n* A NULL pointer dereference flaw was found in the httpd\u0027s mod_ssl module. \nA remote attacker could use this flaw to cause an httpd child process to\ncrash if another module used by httpd called a certain API function during\nthe processing of an HTTPS request. (CVE-2017-3169)\n\n* A NULL pointer dereference flaw was found in the mod_http2 module of\nhttpd. A remote attacker could use this flaw to cause httpd child process\nto crash via a specially crafted HTTP/2 request. (CVE-2017-7659)\n\n* A buffer over-read flaw was found in the httpd\u0027s ap_find_token()\nfunction. A remote attacker could use this flaw to cause httpd child\nprocess to crash via a specially crafted HTTP request. (CVE-2017-7668)\n\n* A buffer over-read flaw was found in the httpd\u0027s mod_mime module. A user\npermitted to modify httpd\u0027s MIME configuration could use this flaw to cause\nhttpd child process to crash. (CVE-2017-7679)\n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted\nautomatically. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass\n1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference\n1463199 - CVE-2017-7659 httpd: mod_http2 NULL pointer dereference\n1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread\n1463207 - CVE-2017-7679 httpd: mod_mime buffer overread\n1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest\n\n6. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):\n\nSource:\nhttpd24-httpd-2.4.25-9.el6.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):\n\nSource:\nhttpd24-httpd-2.4.25-9.el6.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nhttpd24-httpd-2.4.25-9.el6.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el6.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el6.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nhttpd24-httpd-2.4.25-9.el7.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):\n\nSource:\nhttpd24-httpd-2.4.25-9.el7.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nhttpd24-httpd-2.4.25-9.el7.1.src.rpm\n\nnoarch:\nhttpd24-httpd-manual-2.4.25-9.el7.1.noarch.rpm\n\nx86_64:\nhttpd24-httpd-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-debuginfo-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-devel-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-httpd-tools-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ldap-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_proxy_html-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_session-2.4.25-9.el7.1.x86_64.rpm\nhttpd24-mod_ssl-2.4.25-9.el7.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-3167\nhttps://access.redhat.com/security/cve/CVE-2017-3169\nhttps://access.redhat.com/security/cve/CVE-2017-7659\nhttps://access.redhat.com/security/cve/CVE-2017-7668\nhttps://access.redhat.com/security/cve/CVE-2017-7679\nhttps://access.redhat.com/security/cve/CVE-2017-9788\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2017 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFZlNCpXlSAg2UNWIIRArzwAJwNfAuroR6X18rUh+zmjiMy5iBkdwCeJF6e\n4v4GwWYC+5xG0xxXzTEQyAg=\n=UV+2\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. (CVE-2017-7679)\n\n* A use-after-free flaw was found in the way httpd handled invalid and\npreviously unregistered HTTP methods specified in the Limit directive used\nin an .htaccess file. (CVE-2017-9798)\n\nRed Hat would like to thank Hanno BAPck for reporting CVE-2017-9798. 6) - i386, noarch, x86_64\n\n3",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-3167"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
},
{
"db": "BID",
"id": "99135"
},
{
"db": "VULMON",
"id": "CVE-2017-3167"
},
{
"db": "PACKETSTORM",
"id": "181384"
},
{
"db": "PACKETSTORM",
"id": "143044"
},
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "143766"
},
{
"db": "PACKETSTORM",
"id": "144968"
},
{
"db": "PACKETSTORM",
"id": "144969"
}
],
"trust": 2.61
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2017-3167",
"trust": 3.5
},
{
"db": "BID",
"id": "99135",
"trust": 1.9
},
{
"db": "TENABLE",
"id": "TNS-2019-09",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1038711",
"trust": 1.6
},
{
"db": "JVN",
"id": "JVNVU98416507",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2017-3167",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "181384",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143044",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143785",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144960",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143766",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144968",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144969",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-3167"
},
{
"db": "BID",
"id": "99135"
},
{
"db": "PACKETSTORM",
"id": "181384"
},
{
"db": "PACKETSTORM",
"id": "143044"
},
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "143766"
},
{
"db": "PACKETSTORM",
"id": "144968"
},
{
"db": "PACKETSTORM",
"id": "144969"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
},
{
"db": "NVD",
"id": "CVE-2017-3167"
}
]
},
"id": "VAR-201706-0272",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.206875005
},
"last_update_date": "2026-03-05T22:54:09.899000Z",
"patch": {
"_id": null,
"data": [
{
"title": "hitachi-sec-2017-123",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-123/index.html"
},
{
"title": "hitachi-sec-2018-103",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2018-103/index.html"
},
{
"title": "NV17-014",
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv17-014.html"
},
{
"title": "CVE-2017-3167: ap_get_basic_auth_pw authentication bypass",
"trust": 0.8,
"url": "https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4@%3Cdev.httpd.apache.org%3E"
},
{
"title": "hitachi-sec-2017-123",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-123/index.html"
},
{
"title": "hitachi-sec-2018-103",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2018-103/index.html"
},
{
"title": "Apache httpd Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71073"
},
{
"title": "Red Hat: Important: httpd security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173194 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173476 - Security Advisory"
},
{
"title": "Red Hat: Important: httpd security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173193 - Security Advisory"
},
{
"title": "Red Hat: Important: httpd security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173195 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173475 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20173477 - Security Advisory"
},
{
"title": "Red Hat: CVE-2017-3167",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2017-3167"
},
{
"title": "Ubuntu Security Notice: apache2 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3340-1"
},
{
"title": "Arch Linux Issues: ",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2017-3167"
},
{
"title": "Ubuntu Security Notice: apache2 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3373-1"
},
{
"title": "Debian Security Advisories: DSA-3896-1 apache2 -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=a100e91e6529637522c4f74492953f8c"
},
{
"title": "Amazon Linux AMI: ALAS-2017-892",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2017-892"
},
{
"title": "Arch Linux Advisories: [ASA-201706-34] apache: multiple issues",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201706-34"
},
{
"title": "Amazon Linux AMI: ALAS-2017-863",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2017-863"
},
{
"title": "Symantec Security Advisories: SA154: Apache httpd Vulnerabilities June 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=6f891c1513dfb5c26769ed38bcac6e4f"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a22ad41e97bbfc5abb0bb927bf43089c"
},
{
"title": "Tenable Security Advisories: [R1] Tenable.sc 5.13.0 Fixes Multiple Third-Party Vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories\u0026qid=TNS-2019-09"
},
{
"title": "Oracle Linux Bulletins: Oracle Linux Bulletin - July 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins\u0026qid=549dc795290b298746065b62b4bb7928"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - October 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=523d3f220a64ff01dd95e064bd37566a"
},
{
"title": "Final-Project",
"trust": 0.1,
"url": "https://github.com/Jason134526/Final-Project "
},
{
"title": "Cyber-Security-Final-Project",
"trust": 0.1,
"url": "https://github.com/jklinges14/Cyber-Security-Final-Project "
},
{
"title": "GyoiThon",
"trust": 0.1,
"url": "https://github.com/gyoisamurai/GyoiThon "
},
{
"title": "nrich",
"trust": 0.1,
"url": "https://github.com/retr0-13/nrich "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/RoseSecurity-Research/Red-Teaming-TTPs "
},
{
"title": "Red-Teaming-TTPs",
"trust": 0.1,
"url": "https://github.com/RoseSecurity/Red-Teaming-TTPs "
},
{
"title": "Shodan-nrich",
"trust": 0.1,
"url": "https://github.com/PawanKumarPandit/Shodan-nrich "
},
{
"title": "DC-3-Vulnhub-Walkthrough",
"trust": 0.1,
"url": "https://github.com/vshaliii/DC-3-Vulnhub-Walkthrough "
},
{
"title": "DC-1-Vulnhub-Walkthrough",
"trust": 0.1,
"url": "https://github.com/vshaliii/DC-1-Vulnhub-Walkthrough "
},
{
"title": "DC-2-Vulnhub-Walkthrough",
"trust": 0.1,
"url": "https://github.com/vshaliii/DC-2-Vulnhub-Walkthrough "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/hrbrmstr/internetdb "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/SecureAxom/strike "
},
{
"title": "pigat",
"trust": 0.1,
"url": "https://github.com/syadg123/pigat "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-3167"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-287",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
},
{
"db": "NVD",
"id": "CVE-2017-3167"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:2483"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:3193"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:2478"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:3194"
},
{
"trust": 1.7,
"url": "https://access.redhat.com/errata/rhsa-2017:3195"
},
{
"trust": 1.6,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbux03908en_us"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:3477"
},
{
"trust": 1.6,
"url": "https://security.gentoo.org/glsa/201710-32"
},
{
"trust": 1.6,
"url": "https://support.apple.com/ht208221"
},
{
"trust": 1.6,
"url": "https://security.netapp.com/advisory/ntap-20180601-0002/"
},
{
"trust": 1.6,
"url": "http://www.debian.org/security/2017/dsa-3896"
},
{
"trust": 1.6,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id/1038711"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/99135"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:2479"
},
{
"trust": 1.6,
"url": "https://www.nomachine.com/su08o00185"
},
{
"trust": 1.6,
"url": "https://www.tenable.com/security/tns-2019-09"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:3475"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2017:3476"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3167"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4%40%3cdev.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "http://seclists.org/fulldisclosure/2024/sep/22"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 0.8,
"url": "https://access.redhat.com/security/cve/cve-2017-3167"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3167"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98416507/"
},
{
"trust": 0.6,
"url": "httpd.apache.org%3e"
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4@%3cdev."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3ccvs."
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2017-9788"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2017-7679"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7679"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3169"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.5,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2017-3169"
},
{
"trust": 0.5,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9788"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9798"
},
{
"trust": 0.3,
"url": "http://httpd.apache.org/"
},
{
"trust": 0.3,
"url": "https://httpd.apache.org/security/vulnerabilities_22.html"
},
{
"trust": 0.3,
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg24043880"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8n1022204"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg22005280"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-7668"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7668"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-9798"
},
{
"trust": 0.1,
"url": "https://www.syss.de/fileadmin/dokumente/publikationen/advisories/syss-2024-029.txt"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by/3.0/deed.en"
},
{
"trust": 0.1,
"url": "https://www.c-mor.com/"
},
{
"trust": 0.1,
"url": "https://www.syss.de/en/responsible-disclosure-policy/"
},
{
"trust": 0.1,
"url": "https://www.apache.org/dist/httpd/patches/apply_to_2.2.32/cve-2017-3167.patch"
},
{
"trust": 0.1,
"url": "https://httpd.apache.org/security_report.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7659"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-7659"
}
],
"sources": [
{
"db": "BID",
"id": "99135"
},
{
"db": "PACKETSTORM",
"id": "181384"
},
{
"db": "PACKETSTORM",
"id": "143044"
},
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "143766"
},
{
"db": "PACKETSTORM",
"id": "144968"
},
{
"db": "PACKETSTORM",
"id": "144969"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
},
{
"db": "NVD",
"id": "CVE-2017-3167"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "VULMON",
"id": "CVE-2017-3167",
"ident": null
},
{
"db": "BID",
"id": "99135",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "181384",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "143044",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "143785",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "144960",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "143766",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "144968",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "144969",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005023",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2017-3167",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2017-06-20T00:00:00",
"db": "VULMON",
"id": "CVE-2017-3167",
"ident": null
},
{
"date": "2017-06-19T00:00:00",
"db": "BID",
"id": "99135",
"ident": null
},
{
"date": "2024-09-06T16:05:12",
"db": "PACKETSTORM",
"id": "181384",
"ident": null
},
{
"date": "2017-06-20T20:10:11",
"db": "PACKETSTORM",
"id": "143044",
"ident": null
},
{
"date": "2017-08-16T23:35:53",
"db": "PACKETSTORM",
"id": "143785",
"ident": null
},
{
"date": "2017-11-13T22:23:00",
"db": "PACKETSTORM",
"id": "144960",
"ident": null
},
{
"date": "2017-08-15T22:24:00",
"db": "PACKETSTORM",
"id": "143766",
"ident": null
},
{
"date": "2017-11-14T04:32:05",
"db": "PACKETSTORM",
"id": "144968",
"ident": null
},
{
"date": "2017-11-14T04:32:14",
"db": "PACKETSTORM",
"id": "144969",
"ident": null
},
{
"date": "2017-06-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-789",
"ident": null
},
{
"date": "2017-07-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005023",
"ident": null
},
{
"date": "2017-06-20T01:29:00.330000",
"db": "NVD",
"id": "CVE-2017-3167",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2017-3167",
"ident": null
},
{
"date": "2017-08-16T08:10:00",
"db": "BID",
"id": "99135",
"ident": null
},
{
"date": "2021-06-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-789",
"ident": null
},
{
"date": "2018-02-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005023",
"ident": null
},
{
"date": "2025-11-04T16:15:38.937000",
"db": "NVD",
"id": "CVE-2017-3167",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "143785"
},
{
"db": "PACKETSTORM",
"id": "144960"
},
{
"db": "PACKETSTORM",
"id": "143766"
},
{
"db": "PACKETSTORM",
"id": "144968"
},
{
"db": "PACKETSTORM",
"id": "144969"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-789"
}
],
"trust": 1.1
},
"title": {
"_id": null,
"data": "Apache httpd Vulnerabilities in authentication",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005023"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-789"
}
],
"trust": 0.6
}
}
VAR-201511-0308
Vulnerability from variot - Updated: 2025-04-13 23:04Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue. Multiple Adobe products are prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05073670
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c05073670 Version: 1
HPSBST03568 rev.1 - HP XP7 Command View Advanced Edition Suite including Device Manager and Hitachi Automation Director (HAD), Remote Server-Side Request Forgery (SSRF)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2016-04-06 Last Updated: 2016-04-06
Potential Security Impact: Remote Server-Side Request Forgery (SSRF)
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP XP7 Command View Advanced Edition Suite and HP XP P9000 Command View Advanced Edition Software including Device Manager and Hitachi Automation Director (HAD). The vulnerability could be remotely exploited resulting in Server-Side Request Forgery (SSRF).
References: CVE-2015-5255
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP XP P9000 Command View Advanced Edition Software and HP XP7 Command View Advanced Edition Suite:
HP Device Manager Software v7.0.0-00 to earlier than v8.4.0-00 Hitachi Automation Director (HAD) for Windows and Linux v8.1.1-00 to earlier than 8.4.0-00
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2015-5255 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION
HPE has released the following software updates to resolve the vulnerability in HP XP7 Command View Advanced Edition Suite and HP XP P9000 Command View Advanced Edition:
- HP Device Manager Software v8.4.0-00
- Hitachi Automation Director (HAD) for Windows and Linux v8.4.0-00
HISTORY Version:1 (rev.1) - 6 April 2016 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBAgAGBQJXBUdsAAoJEGIGBBYqRO9/QR0H/1n7MvC34yG/bAynnPVOwwun d7+PjDWg6S3zm0X3TTODxNw5XvKtSPW5gsj+ugdkj0MnooGP+ETOLkJgKro6xx+c FvVQChknCB03/Ul+ZED4RXG4XxPAXfrEYisGQ8DogqT8szAEGvkq4AA/aStXYOjT F+yAEJPTMsNZkAeyzWsvJnqxQ7/7BUESJrV5akJvjs7BvArGFWn8FPDjAJuyHGoM D7UD7HLutYaR25TIaqLaVoNokgMq6wLXzLntxM5cB3X98ThYEI23M3XNmxfbhXKQ Q8rAsVpXeGMgObS/nURFMSSPNU7boGZFtSU9mZQilb59V4Xko5wsauUKjP4r8Dk= =xRCI -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201511-0308",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.9,
"vendor": "adobe",
"version": "3.0"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "4.6"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "4.7"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "4.5"
},
{
"model": "xp p9000 command view advanced edition",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": null
},
{
"model": "coldfusion",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "10.0"
},
{
"model": "xp7 command view advanced edition",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": null
},
{
"model": "coldfusion",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "11.0"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "3.0.0.354175"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "3.1.0.354180"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "3.0.x (windows/macintosh/unix)"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "11 update 7"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "10 update 18"
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/automatic operation",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.6.2.x (windows/macintosh/unix)"
},
{
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.7.0.354178"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.5.1.354177"
},
{
"model": "coldfusion",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "11"
},
{
"model": "coldfusion",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "10"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "3.1.x (windows/macintosh/unix)"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.5.x (windows/macintosh/unix)"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.6.2.354178"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.7.x (windows/macintosh/unix)"
},
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software ( domestic version )"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software ( overseas edition )"
},
{
"model": "automation director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "1/automatic operation"
},
{
"model": "device manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "10.0"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "11.0"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "3.1"
}
],
"sources": [
{
"db": "BID",
"id": "77626"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
},
{
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:adobe:coldfusion",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:adobe:livecycle_data_services",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:automation_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:compute_systems_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:device_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_operation",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "James Kettle of PortSwigger Web Security",
"sources": [
{
"db": "BID",
"id": "77626"
}
],
"trust": 0.3
},
"cve": "CVE-2015-5255",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2015-5255",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-5255",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2015-5255",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201511-298",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
},
{
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue. Multiple Adobe products are prone to a security-bypass vulnerability. \nAttackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n\na-c05073670\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05073670\nVersion: 1\n\nHPSBST03568 rev.1 - HP XP7 Command View Advanced Edition Suite including\nDevice Manager and Hitachi Automation Director (HAD), Remote Server-Side\nRequest Forgery (SSRF)\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2016-04-06\nLast Updated: 2016-04-06\n\nPotential Security Impact: Remote Server-Side Request Forgery (SSRF)\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nA potential security vulnerability has been identified with HP XP7 Command\nView Advanced Edition Suite and HP XP P9000 Command View Advanced Edition\nSoftware including Device Manager and Hitachi Automation Director (HAD). The\nvulnerability could be remotely exploited resulting in Server-Side Request\nForgery (SSRF). \n\nReferences: CVE-2015-5255\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP XP P9000 Command View Advanced Edition Software and HP XP7 Command View\nAdvanced Edition Suite:\n\nHP Device Manager Software v7.0.0-00 to earlier than v8.4.0-00\nHitachi Automation Director (HAD) for Windows and Linux v8.1.1-00 to earlier\nthan 8.4.0-00\n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2015-5255 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nHPE has released the following software updates to resolve the vulnerability\nin HP XP7 Command View Advanced Edition Suite and HP XP P9000 Command View\nAdvanced Edition:\n\n - HP Device Manager Software v8.4.0-00\n - Hitachi Automation Director (HAD) for Windows and Linux v8.4.0-00\n\nHISTORY\nVersion:1 (rev.1) - 6 April 2016 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability with any HPE supported\nproduct, send Email to: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAEBAgAGBQJXBUdsAAoJEGIGBBYqRO9/QR0H/1n7MvC34yG/bAynnPVOwwun\nd7+PjDWg6S3zm0X3TTODxNw5XvKtSPW5gsj+ugdkj0MnooGP+ETOLkJgKro6xx+c\nFvVQChknCB03/Ul+ZED4RXG4XxPAXfrEYisGQ8DogqT8szAEGvkq4AA/aStXYOjT\nF+yAEJPTMsNZkAeyzWsvJnqxQ7/7BUESJrV5akJvjs7BvArGFWn8FPDjAJuyHGoM\nD7UD7HLutYaR25TIaqLaVoNokgMq6wLXzLntxM5cB3X98ThYEI23M3XNmxfbhXKQ\nQ8rAsVpXeGMgObS/nURFMSSPNU7boGZFtSU9mZQilb59V4Xko5wsauUKjP4r8Dk=\n=xRCI\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-5255"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "BID",
"id": "77626"
},
{
"db": "PACKETSTORM",
"id": "136600"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-5255",
"trust": 2.8
},
{
"db": "BID",
"id": "77626",
"trust": 1.9
},
{
"db": "SECTRACK",
"id": "1034210",
"trust": 1.6
},
{
"db": "PACKETSTORM",
"id": "134506",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005981",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201511-298",
"trust": 0.6
},
{
"db": "HITACHI",
"id": "HS16-005",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "136600",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "77626"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "PACKETSTORM",
"id": "136600"
},
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
},
{
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"id": "VAR-201511-0308",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.18666667
},
"last_update_date": "2025-04-13T23:04:05.242000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB15-29",
"trust": 0.8,
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html"
},
{
"title": "APSB15-30",
"trust": 0.8,
"url": "https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html"
},
{
"title": "APSB15-29",
"trust": 0.8,
"url": "https://helpx.adobe.com/jp/security/products/coldfusion/apsb15-29.html"
},
{
"title": "APSB15-30",
"trust": 0.8,
"url": "https://helpx.adobe.com/jp/security/products/livecycleds/apsb15-30.html"
},
{
"title": "HS16-007",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-007/index.html"
},
{
"title": "HS16-009",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-009/index.html"
},
{
"title": "HS16-005",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-005/index.html"
},
{
"title": "HS16-007",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-007/index.html"
},
{
"title": "HS16-009",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-009/index.html"
},
{
"title": "HS16-005",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-005/index.html"
},
{
"title": "Adobe ColdFusion and LiveCycle Data Services BlazeDS Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58782"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html"
},
{
"trust": 1.9,
"url": "https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html"
},
{
"trust": 1.9,
"url": "http://www.vmware.com/security/advisories/vmsa-2015-0008.html"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/77626"
},
{
"trust": 1.6,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05073670"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.com/files/134506/apache-flex-blazeds-4.7.1-ssrf.html"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/archive/1/536958/100/0/threaded"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id/1034210"
},
{
"trust": 1.6,
"url": "http://marc.info/?l=bugtraq\u0026m=145996963420108\u0026w=2"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5255"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5255"
},
{
"trust": 0.3,
"url": "http://www.adobe.com/products/coldfusion/"
},
{
"trust": 0.3,
"url": "http://www.adobe.com"
},
{
"trust": 0.3,
"url": "http://www.adobe.com/devnet/livecycle/dataservices.html"
},
{
"trust": 0.3,
"url": "http://seclists.org/bugtraq/2015/nov/118"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05073670"
},
{
"trust": 0.3,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-005/index.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5255"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/subscriber_choice"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/security_bulletin_archive"
}
],
"sources": [
{
"db": "BID",
"id": "77626"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "PACKETSTORM",
"id": "136600"
},
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
},
{
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "77626"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"db": "PACKETSTORM",
"id": "136600"
},
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
},
{
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-11-17T00:00:00",
"db": "BID",
"id": "77626"
},
{
"date": "2015-11-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"date": "2016-04-07T01:07:53",
"db": "PACKETSTORM",
"id": "136600"
},
{
"date": "2015-11-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201511-298"
},
{
"date": "2015-11-18T21:59:00.130000",
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-05T22:03:00",
"db": "BID",
"id": "77626"
},
{
"date": "2016-03-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005981"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201511-298"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-5255"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe ColdFusion and LiveCycle Data Services Used in Adobe BlazeDS In HTTP Vulnerability in sending traffic to intranet servers",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005981"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201511-298"
}
],
"trust": 0.6
}
}
VAR-201508-0177
Vulnerability from variot - Updated: 2025-04-13 23:04Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the AMF protocol. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the fmserver user. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. However this expanded information is not automatically transferred back to the client, but could be made available by the application. ------------------------------------------------------------------------ VMware Security Advisory
Advisory ID: VMSA-2015-0008 Synopsis: VMware product updates address information disclosure issue
Issue date: 2015-11-18 Updated on: 2015-11-18 CVE number: CVE-2015-3269
- Summary
VMware product updates address information disclosure issue.
- Relevant Releases
VMware vCenter Server 5.5 prior to version 5.5 update 3 VMware vCenter Server 5.1 prior to version 5.1 update u3b VMware vCenter Server 5.0 prior to version 5.0 update u3e
vCloud Director 5.6 prior to version 5.6.4 vCloud Director 5.5 prior to version 5.5.3
VMware Horizon View 6.0 prior to version 6.1 VMware Horizon View 5.0 prior to version 5.3.4
- Problem Description
a. vCenter Server, vCloud Director, Horizon View information disclosure issue. A specially crafted XML request sent to the server could lead to unintended information be disclosed.
VMware would like to thank Matthias Kaiser of Code White GmbH for
reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-3269 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
vCenter Server 6.0 any not affected
vCenter Server 5.5 any 5.5 update 3
vCenter Server 5.1 any 5.1 update u3b
vCenter Server 5.0 any 5.5 update u3e
vCloud Director 5.6 any 5.6.4
vCloud Director 5.5 any 5.5.3
Horizon View 6.0 any 6.1
Horizon View 5.3 any 5.3.4
- Solution
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
vCenter Server
Downloads and Documentation: https://www.vmware.com/go/download-vsphere
vCloud Director For Service Providers
Downloads and Documentation: https://www.vmware.com/support/pubs/vcd_pubs.html
Horizon View 6.1, 5.3.4:
Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productId=492 https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&productId=396
- References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3269
- Change log
2015-11-18 VMSA-2015-0008 Initial security advisory
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com bugtraq at securityfocus.com fulldisclosure at seclists.org
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories http://kb.vmware.com/kb/2078735
VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html
Twitter https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05026202
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c05026202 Version: 2
HPSBGN03550 rev.2 - HP Operations Manager i and BSM using Apache Flex BlazeDS, Remote Disclosure of Information
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2016-03-03 Last Updated: 2016-03-03
Potential Security Impact: Remote Disclosure of Information
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY A security vulnerability in Apache Flex BlazeDS was addressed by HP Operations Manager i (OMi) and Business Service Manager (BSM).
Note : OMi v10.10 is NOT affected by this vulnerability.
References:
CVE-2015-3269 SSRT102232
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
Operations Manager i v10.0, v10.01 Business Service Manager v9.x to v9.26
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2015-3269 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
The Hewlett Packard Enterprise Company thanks Nicholas Miles from Tenable Network Security for reporting this issue to security-alert@hpe.com
RESOLUTION
HPE has made the following mitigation information available to resolve the vulnerability for the impacted versions of Operations Manager i and Business Service Manager:
For OMi 10.0 update to OMi 10.0 IP3 or above. The OMi 10.0 IP3 patches can be found here:
For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/OMI_00122?lang=en&cc=us&hpappid=202392_OSP_PRO_ HPE
For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/OMI_00123?lang=en&cc=us&hpappid=202392_OSP_PRO_HP E
For OMi 10.01 update to OMi 10.01 IP2 or above. The OMi 10.01 IP2 patches can be found here:
For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/OMI_00120
For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/OMI_00121
OMi 10.10 is NOT affected by this vulnerability.
For BSM 9.x to 9.25, update to BSM 9.25 IP2 or above.
For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/BAC_00899
For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/BAC_00896
For BSM 9.26 please contact HPE Technical Support.
HISTORY Version:1 (rev.1) - 3 March 2016 Initial release Version:2 (rev.2) - 3 March 2016 Added acknowledgment section
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBAgAGBQJW2GZoAAoJEGIGBBYqRO9/g7wIAIuGN+IoM69sf1dzu0wROFfj fDKMymKIsUz975nC1VoPm+70FiBRNKwuL73uqA7Gkrhnv1ldxeBjsX058FR3q5ZE mhlhfp86BMKJMtuWI3nTVo25gQM4PVaB6GuS52PrROhwcNRKnGy6K1OlYPEtFXiy OC6YNBwBBbvookB6bPkziPzvdc85zTU8Pc7YDZQoO14vw/k1PDBaFSHs7QnLlrAw 2cZADbYL9QIDWjIO/QVHo8iwYkjpxRmBzK6qXg/Ys1vij6/RYLqMtk5fxxMRlkfS 0oiFiUS8zVf+QASHRAuj4KXeCOCi66UEAgewkDa15GyByubl8WQRg7ovw1fHGUA= =4Dvo -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0177",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.9,
"vendor": "adobe",
"version": "3.0"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.9,
"vendor": "adobe",
"version": "4.7"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.9,
"vendor": "adobe",
"version": "4.5"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "4.6"
},
{
"model": "business service management",
"scope": "lte",
"trust": 1.0,
"vendor": "hp",
"version": "9.26"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "adobe",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apache",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "atlassian",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "vmware",
"version": null
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "3.0.0.354170"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.6.2"
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/automatic operation",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.5.1.354169"
},
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software ( domestic version )"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "3.0.x"
},
{
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software ( overseas edition )"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.7.0.354169"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.7"
},
{
"model": "automation director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "1/automatic operation"
},
{
"model": "device manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.6.2.354169"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.5"
},
{
"model": "nexus dashboard fabric controller",
"scope": null,
"trust": 0.7,
"vendor": "cisco",
"version": null
},
{
"model": "vcloud director",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5"
},
{
"model": "vcloud director",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.6"
},
{
"model": "vcenter server update1",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.52"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.13"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.11"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.1"
},
{
"model": "vcenter server update2",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "vcenter server update u3b",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "vcenter server update 3c",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.01"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "horizon view",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.3.1"
},
{
"model": "horizon view",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.0"
},
{
"model": "horizon view",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.3"
},
{
"model": "operations manager i",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.01"
},
{
"model": "operations manager i",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.00"
},
{
"model": "business service manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.26"
},
{
"model": "business service manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.20"
},
{
"model": "business service manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.10"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-02"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-01"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00-02"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-50"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-10-01"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00-03"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00-02"
},
{
"model": "flex blazeds",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "4.7"
},
{
"model": "flex blazeds",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "4.6.0.23207"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "4.6.2"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "115"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "114"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "113"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "112"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "111"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.08"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.04"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.03"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.02"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.01"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "109"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "106"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "105"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1016"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1015"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1014"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1013"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1012"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1011"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1010"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "101"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10"
},
{
"model": "vcloud director",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.6.4"
},
{
"model": "vcloud director",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5.3"
},
{
"model": "vcenter server update",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.53"
},
{
"model": "vcenter server update u3b",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.1"
},
{
"model": "vcenter server update u3e",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "horizon view",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.3.4"
},
{
"model": "horizon view",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "6.1"
},
{
"model": "jp1/automatic operation",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": "11-00-01"
},
{
"model": "flex blazeds",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "4.7.1"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "6.2.354169"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "4.7.0.3541694"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "4.5.1.354169"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "3.0.0.354170"
},
{
"model": "coldfusion update",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "116"
},
{
"model": "coldfusion update",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "1017"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:adobe:livecycle_data_services",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:automation_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:compute_systems_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:device_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_operation",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kpc",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
],
"trust": 1.3
},
"cve": "CVE-2015-3269",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2015-3269",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"availabilityRequirement": "MEDIUM",
"baseScore": 4.3,
"collateralDamagePotential": "LOW-MEDIUM",
"confidentialityImpact": "PARTIAL",
"confidentialityRequirement": "MEDIUM",
"enviromentalScore": 1.4,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 3.1,
"id": "CVE-2016-2340",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"integrityRequirement": "MEDIUM",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "NOT DEFINED",
"reportConfidence": "UNCOFIRMED",
"severity": "MEDIUM",
"targetDistribution": "LOW",
"trust": 0.8,
"userInteractionRequired": null,
"vector_string": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2015-3269",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-3269",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2016-2340",
"trust": 0.8,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2015-3269",
"trust": 0.8,
"value": "Medium"
},
{
"author": "ZDI",
"id": "CVE-2015-3269",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-438",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#279472"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the AMF protocol. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the fmserver user. \nAttackers can exploit this issue to obtain sensitive information that may lead to further attacks. \nHowever this expanded information is not automatically transferred back to\nthe client, but could be made available by the application. ------------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2015-0008\nSynopsis: VMware product updates address information disclosure\n issue\n\nIssue date: 2015-11-18\nUpdated on: 2015-11-18\nCVE number: CVE-2015-3269\n------------------------------------------------------------------------\n\n1. Summary\n\n VMware product updates address information disclosure issue. \n\n\n2. Relevant Releases\n\n VMware vCenter Server 5.5 prior to version 5.5 update 3\n VMware vCenter Server 5.1 prior to version 5.1 update u3b\n VMware vCenter Server 5.0 prior to version 5.0 update u3e\n\n vCloud Director 5.6 prior to version 5.6.4\n vCloud Director 5.5 prior to version 5.5.3\n\n VMware Horizon View 6.0 prior to version 6.1\n VMware Horizon View 5.0 prior to version 5.3.4\n\n\n\n3. Problem Description\n\n a. vCenter Server, vCloud Director, Horizon View information\n disclosure issue. A specially\n crafted XML request sent to the server could lead to unintended\n information be disclosed. \n\n VMware would like to thank Matthias Kaiser of Code White GmbH for\n reporting this issue to us. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the identifier CVE-2015-3269 to this issue. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product\t Running Replace with/\n Product Version\t on Apply Patch\n =============\t=======\t ======= =================\n vCenter Server 6.0 any not affected\n vCenter Server 5.5 any 5.5 update 3\n vCenter Server 5.1 any 5.1 update u3b\n vCenter Server 5.0 any 5.5 update u3e\n\n vCloud Director 5.6 any 5.6.4\n vCloud Director 5.5 any 5.5.3\n\n Horizon View 6.0 any 6.1\n Horizon View 5.3 any 5.3.4\n\n\n4. Solution\n\n Please review the patch/release notes for your product and version\n and verify the checksum of your downloaded file. \n\n\n vCenter Server\n --------------------------------\n Downloads and Documentation:\n https://www.vmware.com/go/download-vsphere\n\n vCloud Director For Service Providers\n --------------------------------\n Downloads and Documentation:\n https://www.vmware.com/support/pubs/vcd_pubs.html\n\n Horizon View 6.1, 5.3.4:\n --------------------------------\n Downloads:\n https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA\u0026productId=492\n https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER\u0026productId=396\n\n\n5. References\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3269\n\n------------------------------------------------------------------------\n\n6. Change log\n\n 2015-11-18 VMSA-2015-0008\n Initial security advisory\n\n------------------------------------------------------------------------\n\n7. Contact\n\n E-mail list for product security notifications and announcements:\n http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\n This Security Advisory is posted to the following lists:\n\n security-announce at lists.vmware.com\n bugtraq at securityfocus.com\n fulldisclosure at seclists.org\n\n E-mail: security at vmware.com\n PGP key at: http://kb.vmware.com/kb/1055\n\n VMware Security Advisories\n http://www.vmware.com/security/advisories\n\n Consolidated list of VMware Security Advisories\n http://kb.vmware.com/kb/2078735\n\n VMware Security Response Policy\n https://www.vmware.com/support/policies/security_response.html\n\n VMware Lifecycle Support Phases\n https://www.vmware.com/support/policies/lifecycle.html\n\n Twitter\n https://twitter.com/VMwareSRC\n\n Copyright 2015 VMware Inc. All rights reserved. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n\na-c05026202\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05026202\nVersion: 2\n\nHPSBGN03550 rev.2 - HP Operations Manager i and BSM using Apache Flex\nBlazeDS, Remote Disclosure of Information\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2016-03-03\nLast Updated: 2016-03-03\n\nPotential Security Impact: Remote Disclosure of Information\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nA security vulnerability in Apache Flex BlazeDS was addressed by HP\nOperations Manager i (OMi) and Business Service Manager (BSM). \n\nNote : OMi v10.10 is NOT affected by this vulnerability. \n\nReferences:\n\nCVE-2015-3269\nSSRT102232\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \n\nOperations Manager i v10.0, v10.01\nBusiness Service Manager v9.x to v9.26\n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2015-3269 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nThe Hewlett Packard Enterprise Company thanks Nicholas Miles from Tenable\nNetwork Security for reporting this issue to security-alert@hpe.com\n\nRESOLUTION\n\nHPE has made the following mitigation information available to resolve the\nvulnerability for the impacted versions of Operations Manager i and Business\nService Manager:\n\nFor OMi 10.0 update to OMi 10.0 IP3 or above. \nThe OMi 10.0 IP3 patches can be found here:\n\nFor Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu\nlt/-/facetsearch/document/LID/OMI_00122?lang=en\u0026cc=us\u0026hpappid=202392_OSP_PRO_\nHPE\n\nFor Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result\n/-/facetsearch/document/LID/OMI_00123?lang=en\u0026cc=us\u0026hpappid=202392_OSP_PRO_HP\nE\n\nFor OMi 10.01 update to OMi 10.01 IP2 or above. \nThe OMi 10.01 IP2 patches can be found here:\n\nFor Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu\nlt/-/facetsearch/document/LID/OMI_00120\n\nFor Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result\n/-/facetsearch/document/LID/OMI_00121\n\nOMi 10.10 is NOT affected by this vulnerability. \n\nFor BSM 9.x to 9.25, update to BSM 9.25 IP2 or above. \n\nFor Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu\nlt/-/facetsearch/document/LID/BAC_00899\n\nFor Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result\n/-/facetsearch/document/LID/BAC_00896\n\nFor BSM 9.26 please contact HPE Technical Support. \n\nHISTORY\nVersion:1 (rev.1) - 3 March 2016 Initial release\nVersion:2 (rev.2) - 3 March 2016 Added acknowledgment section\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability with any HPE supported\nproduct, send Email to: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAEBAgAGBQJW2GZoAAoJEGIGBBYqRO9/g7wIAIuGN+IoM69sf1dzu0wROFfj\nfDKMymKIsUz975nC1VoPm+70FiBRNKwuL73uqA7Gkrhnv1ldxeBjsX058FR3q5ZE\nmhlhfp86BMKJMtuWI3nTVo25gQM4PVaB6GuS52PrROhwcNRKnGy6K1OlYPEtFXiy\nOC6YNBwBBbvookB6bPkziPzvdc85zTU8Pc7YDZQoO14vw/k1PDBaFSHs7QnLlrAw\n2cZADbYL9QIDWjIO/QVHo8iwYkjpxRmBzK6qXg/Ys1vij6/RYLqMtk5fxxMRlkfS\n0oiFiUS8zVf+QASHRAuj4KXeCOCi66UEAgewkDa15GyByubl8WQRg7ovw1fHGUA=\n=4Dvo\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-3269"
},
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "CERT/CC",
"id": "VU#279472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
}
],
"trust": 4.23
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.kb.cert.org/vuls/id/279472",
"trust": 0.8,
"type": "poc"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#279472"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-3269",
"trust": 4.5
},
{
"db": "ZDI",
"id": "ZDI-22-508",
"trust": 2.3
},
{
"db": "BID",
"id": "76394",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#279472",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1033337",
"trust": 1.6
},
{
"db": "CERT/CC",
"id": "VU#307983",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-15192",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "46622",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438",
"trust": 0.6
},
{
"db": "HITACHI",
"id": "HS16-005",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "133250",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134439",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "136084",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "CERT/CC",
"id": "VU#279472"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"id": "VAR-201508-0177",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.18666667
},
"last_update_date": "2025-04-13T23:04:05.185000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB15-20",
"trust": 0.8,
"url": "https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html"
},
{
"title": "APSB15-20",
"trust": 0.8,
"url": "https://helpx.adobe.com/jp/security/products/livecycleds/apsb15-20.html"
},
{
"title": "HS16-009",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-009/index.html"
},
{
"title": "HS16-005",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-005/index.html"
},
{
"title": "HS15-028",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS15-028/index.html"
},
{
"title": "HS16-009",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-009/index.html"
},
{
"title": "HS16-005",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-005/index.html"
},
{
"title": "HS15-028",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS15-028/index.html"
},
{
"title": "LCDS_4.6.2",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57450"
},
{
"title": "LCDS_4.5.1",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57449"
},
{
"title": "LCDS_3.1.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57448"
},
{
"title": "LCDS_3.0.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57447"
},
{
"title": "LCDS_4.7.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57451"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://www.zerodayinitiative.com/advisories/zdi-22-508/"
},
{
"trust": 1.9,
"url": "https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id/1033337"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/archive/1/536266/100/0/threaded"
},
{
"trust": 1.6,
"url": "http://www.vmware.com/security/advisories/vmsa-2015-0008.html"
},
{
"trust": 1.6,
"url": "http://marc.info/?l=bugtraq\u0026m=145706712500978\u0026w=2"
},
{
"trust": 1.6,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05026202"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/76394"
},
{
"trust": 1.6,
"url": "https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3269"
},
{
"trust": 0.8,
"url": "http://codewhitesec.blogspot.com/2017/04/amf.html"
},
{
"trust": 0.8,
"url": "http://openjdk.java.net/jeps/290"
},
{
"trust": 0.8,
"url": "http://www.kb.cert.org/vuls/id/279472"
},
{
"trust": 0.8,
"url": "http://www.adobe.com/go/amfspec"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/502.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/913.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/611.html"
},
{
"trust": 0.8,
"url": "https://flex.apache.org/download-blazeds.html"
},
{
"trust": 0.8,
"url": "https://www.vmware.com/security/advisories/vmsa-2017-0007.html"
},
{
"trust": 0.8,
"url": "http://codewhitesec.blogspot.com/2015/08/cve-2015-3269-apache-flex-blazeds-xxe.html"
},
{
"trust": 0.8,
"url": "https://www.owasp.org/index.php/xml_external_entity_%28xxe%29_processing"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3269"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/archive/1/archive/1/536266/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/46622"
},
{
"trust": 0.3,
"url": "http://www.adobe.com"
},
{
"trust": 0.3,
"url": "http://www.adobe.com/devnet/livecycle/dataservices.html"
},
{
"trust": 0.3,
"url": "http://seclists.org/oss-sec/2015/q3/394"
},
{
"trust": 0.3,
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb15-21.html"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05026202"
},
{
"trust": 0.3,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-005/index.html"
},
{
"trust": 0.3,
"url": "http://www.vmware.com/security/advisories/vmsa-2015-0008"
},
{
"trust": 0.3,
"url": "http://www.kb.cert.org/vuls/id/307983"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3269"
},
{
"trust": 0.1,
"url": "https://www.owasp.org/index.php/xml_external_entity_(xxe)_processing"
},
{
"trust": 0.1,
"url": "https://twitter.com/vmwaresrc"
},
{
"trust": 0.1,
"url": "https://my.vmware.com/web/vmware/details?downloadgroup=view-534-premier\u0026productid=396"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/support/policies/lifecycle.html"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1055"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/security/advisories"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/go/download-vsphere"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/2078735"
},
{
"trust": 0.1,
"url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/support/policies/security_response.html"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/support/pubs/vcd_pubs.html"
},
{
"trust": 0.1,
"url": "https://my.vmware.com/web/vmware/details?downloadgroup=view-610-ga\u0026productid=492"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hp.com/group/softwaresupport/search-resu"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/security_bulletin_archive"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/subscriber_choice"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hp.com/group/softwaresupport/search-result"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "CERT/CC",
"id": "VU#279472"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "CERT/CC",
"id": "VU#279472"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-04T00:00:00",
"db": "CERT/CC",
"id": "VU#307983"
},
{
"date": "2016-03-24T00:00:00",
"db": "CERT/CC",
"id": "VU#279472"
},
{
"date": "2022-03-11T00:00:00",
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"date": "2015-08-18T00:00:00",
"db": "BID",
"id": "76394"
},
{
"date": "2015-08-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"date": "2015-08-22T13:33:33",
"db": "PACKETSTORM",
"id": "133250"
},
{
"date": "2015-11-19T14:15:30",
"db": "PACKETSTORM",
"id": "134439"
},
{
"date": "2016-03-04T16:03:09",
"db": "PACKETSTORM",
"id": "136084"
},
{
"date": "2015-08-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"date": "2015-08-25T01:59:00.087000",
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-14T00:00:00",
"db": "CERT/CC",
"id": "VU#307983"
},
{
"date": "2016-03-24T00:00:00",
"db": "CERT/CC",
"id": "VU#279472"
},
{
"date": "2022-03-11T00:00:00",
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"date": "2017-04-11T01:03:00",
"db": "BID",
"id": "76394"
},
{
"date": "2016-03-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"date": "2022-03-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references",
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
],
"trust": 0.6
}
}
VAR-201307-0480
Vulnerability from variot - Updated: 2025-04-11 23:15Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 through 10-00-02, and 10-01 through 10-01-02; Hitachi Job Management Partner 1/IT Desktop Management - Manager 09-50 through 09-50-03 and 10-01; and Hitachi IT Operations Director 02-50 through 02-50-07, 03-00 through 03-00-12, and 04-00 through 04-00-01 allow remote authenticated users to gain privileges via unknown vectors. Taizo Tsukamoto of GLOBAL SECURITY EXPERTS inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Users without administrative privileges may obtain administrative privileges. Multiple Hitachi products have security holes that allow local attackers to use the holes to elevate privileges.
No detailed vulnerability details are provided at this time. A local attacker may leverage these issues to escalate privileges. This may lead to other attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201307-0480",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "it operations director",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "03-00-08"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "03-00-07"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "03-00-04"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "03-00"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "02-50-07"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "02-50-06"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "02-50-01"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "03-00-12"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "04-00-01"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "04-00"
},
{
"model": "it operations director",
"scope": null,
"trust": 1.4,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "09-50"
},
{
"model": "jp1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "09-51"
},
{
"model": "jp1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "10-01"
},
{
"model": "it operations director",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "02-50"
},
{
"model": "jp1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "09-51-05"
},
{
"model": "jp1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "10-00"
},
{
"model": "jp1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "10-01-02"
},
{
"model": "job management partner 1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "09-50-03"
},
{
"model": "jp1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "10-00-02"
},
{
"model": "job management partner 1\\/it desktop management-manager",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "10-01"
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it desktop management manager",
"scope": "eq",
"trust": 0.6,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/it desktop management",
"scope": null,
"trust": 0.6,
"vendor": "hitachi",
"version": null
},
{
"model": "it operations director",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "03-00-06"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"db": "BID",
"id": "61459"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-665"
},
{
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Taizo Tsukamoto of GLOBAL SECURITY EXPERTS Inc.",
"sources": [
{
"db": "BID",
"id": "61459"
}
],
"trust": 0.3
},
"cve": "CVE-2013-4697",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2013-4697",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 5.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2013-000076",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.1,
"id": "CNVD-2013-11031",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-4697",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2013-000076",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2013-11031",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201307-665",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-665"
},
{
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 through 10-00-02, and 10-01 through 10-01-02; Hitachi Job Management Partner 1/IT Desktop Management - Manager 09-50 through 09-50-03 and 10-01; and Hitachi IT Operations Director 02-50 through 02-50-07, 03-00 through 03-00-12, and 04-00 through 04-00-01 allow remote authenticated users to gain privileges via unknown vectors. Taizo Tsukamoto of GLOBAL SECURITY EXPERTS inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Users without administrative privileges may obtain administrative privileges. Multiple Hitachi products have security holes that allow local attackers to use the holes to elevate privileges. \n\nNo detailed vulnerability details are provided at this time. \nA local attacker may leverage these issues to escalate privileges. This may lead to other attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-4697"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"db": "BID",
"id": "61459"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-4697",
"trust": 3.3
},
{
"db": "JVN",
"id": "JVN00065218",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076",
"trust": 2.4
},
{
"db": "HITACHI",
"id": "HS13-017",
"trust": 2.2
},
{
"db": "BID",
"id": "61459",
"trust": 0.9
},
{
"db": "SECUNIA",
"id": "54231",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2013-11031",
"trust": 0.6
},
{
"db": "JVN",
"id": "JVN#00065218",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201307-665",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"db": "BID",
"id": "61459"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-665"
},
{
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"id": "VAR-201307-0480",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
}
],
"trust": 0.78666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
}
]
},
"last_update_date": "2025-04-11T23:15:25.851000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HS13-017",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-017/index.html"
},
{
"title": "Patch for Unknown Local Privilege Escalation Vulnerability in Hitachi Multiple Products",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/36558"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-264",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://jvn.jp/en/jp/jvn00065218/index.html"
},
{
"trust": 2.2,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs13-017/index.html"
},
{
"trust": 1.6,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2013-000076"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4697"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4697"
},
{
"trust": 0.6,
"url": "http://www.secunia.com/advisories/54231/"
},
{
"trust": 0.3,
"url": "http://www.hitachi.com"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"db": "BID",
"id": "61459"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-665"
},
{
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"db": "BID",
"id": "61459"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"db": "CNNVD",
"id": "CNNVD-201307-665"
},
{
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-08-01T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"date": "2013-07-26T00:00:00",
"db": "BID",
"id": "61459"
},
{
"date": "2013-07-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"date": "2013-07-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201307-665"
},
{
"date": "2013-07-31T13:20:19.103000",
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-08-01T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-11031"
},
{
"date": "2013-08-01T18:27:00",
"db": "BID",
"id": "61459"
},
{
"date": "2013-08-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-000076"
},
{
"date": "2013-08-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201307-665"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2013-4697"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201307-665"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "JP1/IT Desktop Management - Manager and Hitachi IT Operations Director vulnerable to privilege escalation",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000076"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201307-665"
}
],
"trust": 0.6
}
}
VAR-201905-1436
Vulnerability from variot - Updated: 2022-05-04 10:15A DoS Vulnerability was found in Hitachi IT Operations Director, JP1/IT Desktop Management - Manager and JP1/IT Desktop Management 2 - Manager. Regarding the impact of the vulnerability, please refer to the vendor advisory.
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201905-1436",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it desktop management 2 - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - operations director"
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A DoS Vulnerability was found in Hitachi IT Operations Director, JP1/IT Desktop Management - Manager and JP1/IT Desktop Management 2 - Manager. Regarding the impact of the vulnerability, please refer to the vendor advisory. ",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
],
"trust": 0.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
]
},
"id": "VAR-201905-1436",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.1610577
},
"last_update_date": "2022-05-04T10:15:35.216000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "hitachi-sec-2019-111",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-111/index.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DoS Vulnerability in Hitachi IT Operations Director, JP1/IT Desktop Management - Manager and JP1/IT Desktop Management 2 - Manager",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003539"
}
],
"trust": 0.8
}
}
VAR-201706-1151
Vulnerability from variot - Updated: 2022-05-04 10:12A cross-site scripting and an XML external entity (XXE) vulnerability have been found in Hitachi IT Operations Director, JP1/IT Desktop Management - Manager and JP1/IT Desktop Management 2 - Manager.An attacker may conduct a cross-site scripting attack and a XML external entity (XXE) attack.
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201706-1151",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - operations director"
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "VENDOR",
"availabilityImpact": "Complete",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2017-003108",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "VENDOR",
"availabilityImpact": "High",
"baseScore": 8.1,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2017-003108",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "VENDOR",
"id": "JVNDB-2017-003108",
"trust": 0.8,
"value": "High"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A cross-site scripting and an XML external entity (XXE) vulnerability have been found in Hitachi IT Operations Director, JP1/IT Desktop Management - Manager and JP1/IT Desktop Management 2 - Manager.An attacker may conduct a cross-site scripting attack and a XML external entity (XXE) attack.",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
],
"trust": 0.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"id": "VAR-201706-1151",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.1610577
},
"last_update_date": "2022-05-04T10:12:08.552000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "hitachi-sec-2017-112",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-112/index.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-06-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-06-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Vulnerabilities in Hitachi IT Operations Director and JP1/IT Desktop Management",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003108"
}
],
"trust": 0.8
}
}
VAR-201502-0541
Vulnerability from variot - Updated: 2022-05-04 09:12A cross-site scripting vulnerability was found in the online help of JP1/IT Desktop Management - Manager and Hitachi IT Operations Director. Remote users can exploit a cross-site scripting vulnerability to execute malicious scripts.
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201502-0541",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "VENDOR",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2015-001557",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "VENDOR",
"id": "JVNDB-2015-001557",
"trust": 0.8,
"value": "Medium"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A cross-site scripting vulnerability was found in the online help of JP1/IT Desktop Management - Manager and Hitachi IT Operations Director. Remote users can exploit a cross-site scripting vulnerability to execute malicious scripts. ",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
],
"trust": 0.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"id": "VAR-201502-0541",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.1610577
},
"last_update_date": "2022-05-04T09:12:08.707000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HS15-005",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs15-005/index.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-02-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-02-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site Scripting Vulnerability in JP1/IT Desktop Management - Manager and Hitachi IT Operations Director",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001557"
}
],
"trust": 0.8
}
}
VAR-201709-1255
Vulnerability from variot - Updated: 2022-05-04 09:11A vulnerability to denial-of-service attacks was found in JP1 and Hitachi IT Operations Director.An attacker may conduct denial-of-service attacks.
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201709-1255",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/asset information manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/asset information manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "embedded rdb edition"
},
{
"model": "job management partner 1/automatic job management system 2",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- advanced manager"
},
{
"model": "job management partner 1/automatic job management system 2",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "job management partner 1/automatic job management system 3",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"model": "job management partner 1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
},
{
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it service level management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "job management partner 1/software distribution manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/software distribution manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "embedded rdb edition"
},
{
"model": "jp1/automatic job management system 2",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- advanced manager"
},
{
"model": "jp1/automatic job management system 2",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "jp1/automatic job management system 3",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "jp1/automatic operation",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support"
},
{
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support advanced edition"
},
{
"model": "jp1/integrated management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- service support starter edition"
},
{
"model": "jp1/integrated manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- incident master"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - operations director"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - smart device manager"
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/it service level management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "jp1/netm/asset information manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/netm/asset information manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "embedded rdb edition"
},
{
"model": "jp1/netm/asset information manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "for blade pc"
},
{
"model": "jp1/netm/dm",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "manager"
},
{
"model": "jp1/netm/dm",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "manager embedded rdb edition"
},
{
"model": "jp1/operations analytics",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/performance analysis",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "jp1/performance management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- analysis manager"
},
{
"model": "jp1/serverconductor/control manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/service level management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "jp1/service support",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/service support",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "starter edition"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:hitachi:it_operations_director",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_asset_information_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_automatic_job_management_system_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_automatic_job_management_system_3",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_it_service_level_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_software_distribution_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_job_management_system_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_job_management_system_3",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_automatic_operation",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_integrated_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_integrated_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_it_service_level_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_netm_asset_information_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_netm_dm",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_operation_analytics",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_performance_analysis",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_performance_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_serverconductor_control_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_service_level_management",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:jp1_service_support",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "VENDOR",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-006769",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "VENDOR",
"availabilityImpact": "Low",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-006769",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "VENDOR",
"id": "JVNDB-2017-006769",
"trust": 0.8,
"value": "Medium"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability to denial-of-service attacks was found in JP1 and Hitachi IT Operations Director.An attacker may conduct denial-of-service attacks.",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
],
"trust": 0.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"id": "VAR-201709-1255",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.20350765
},
"last_update_date": "2022-05-04T09:11:15.536000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "hitachi-sec-2017-122",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-122/index.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Denial-of-service (DoS) Vulnerability in JP1 and Hitachi IT Operations Director",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006769"
}
],
"trust": 0.8
}
}