ID de Prueba:	1.3.6.1.4.1.25623.1.0.122787
Categoría:	Oracle Linux Local Security Checks
Título:	Oracle: Security Advisory (ELSA-2015-2199)
Resumen:	The remote host is missing an update for the 'glibc' package(s) announced via the ELSA-2015-2199 advisory.
Descripción:	Summary: The remote host is missing an update for the 'glibc' package(s) announced via the ELSA-2015-2199 advisory. Vulnerability Insight: [2.17-105.0.1] - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. [2.17-105] - Fix up test case for initial-exec fix (#1248208). [2.17-104] - Mark all TLS variables in libc.so as initial-exec (#1248208). [2.17-103] - Apply correct fix for #1195672. [2.17-102] - Remove workaround for kernel netlink bug (#1089836). - Use only 32-bit instructions in optimized 32-bit POWER functions (#1240796). [2.17-101] - Correct the AArch64 ABI baseline for libpthread (#1234622). [2.17-100] - Prevent tst-rec-dlopen from intermittently failing in parallel builds due to a missing makefile dependency (#1225959). [2.17-99] - Increase AArch64 TLS descriptor performance (#1202952). [2.17-98] - Move arch-specific header files from glibc-headers to glibc-devel (#1230328). [2.17-97] - Rebase high-precision timing support for microbenchmark (#1214326). [2.17-96] - Rebase microbenchmarks from upstream for performance testing (#1214326) - Fix running microbenchmark script bench.pl from source (#1084395) [2.17-95] - Enable systemtap support for all architectures (#1225490). [2.17-94] - Fix ruserok API scalability issues (#1216246). [2.17-93] - Backport fixes and enhancements for ppc64 and ppc64le (#1162895). - Correct DT_PPC64_NUM in elf/elf.h. - Correct IBM long double frexpl. - Correct IBM long double nextafterl. [2.17-92] - Backport fixes for various security flaws (#1209107): - Prevent heap buffer overflow in swscanf (CVE-2015-1472, CVE-2015-1473, - Prevent integer overflow in _IO_wstr_overflow (#1195762). - Prevent potential denial of service in internal_fnmatch (#1197730). - Prevent buffer overflow in gethostbyname_r and related functions with misaligned buffer (CVE-2015-1781, #1199525). [2.17-91] - Allow more shared libraries with static TLS to be loaded (#1227699). [2.17-90] - Work around kernel netlink bug on some specialized hardware setup (#1089836). - Fix invalid file descriptor reuse when sending DNS query (CVE-2013-7423, #1194143). - Sync netinet/tcp.h with the kernel (#1219891). [2.17-89] - Avoid deadlock in malloc on backtrace (#1207032). - Actually test iconv modules (#1176906). - Use calloc to allocate xports (#1159169). - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN (#1098042). [2.17-88] - Add librtkaio.abilist generated by make update-abi (#1173238). [2.18-87] - Enhance nscd inotify support (#1193797). [2.17-86] - Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (#1173537). [2.17-85] - Skip logging for DNSSEC responses (#1186620). - Also apply the RHEL6.7 Makerules patch (#1189278). [2.17-84] - Initialize nscd stats data (#1183456). [2.17-83] - Resize DTV if the current DTV isn't big enough (#1189278). [2.17-82] - Backport an alternate implementation of strstr and strcasestr for x86 that ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'glibc' package(s) on Oracle Linux 7. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-7423 BugTraq ID: 72844 http://www.securityfocus.com/bid/72844 http://seclists.org/fulldisclosure/2021/Sep/0 https://security.gentoo.org/glsa/201602-02 http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html http://www.openwall.com/lists/oss-security/2015/01/28/20 RedHat Security Advisories: RHSA-2015:0863 http://rhn.redhat.com/errata/RHSA-2015-0863.html RedHat Security Advisories: RHSA-2016:1207 https://access.redhat.com/errata/RHSA-2016:1207 SuSE Security Announcement: openSUSE-SU-2015:0351 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html http://www.ubuntu.com/usn/USN-2519-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-1472 BugTraq ID: 72428 http://www.securityfocus.com/bid/72428 Bugtraq: 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series (Google Search) https://seclists.org/bugtraq/2019/Jun/14 Bugtraq: 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X (Google Search) https://seclists.org/bugtraq/2019/Sep/7 http://seclists.org/fulldisclosure/2019/Jun/18 http://seclists.org/fulldisclosure/2019/Sep/7 http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html https://sourceware.org/ml/libc-alpha/2015-02/msg00119.html http://openwall.com/lists/oss-security/2015/02/04/1 Common Vulnerability Exposure (CVE) ID: CVE-2015-1473 BugTraq ID: 72499 http://www.securityfocus.com/bid/72499 Common Vulnerability Exposure (CVE) ID: CVE-2015-1781 1032178 http://www.securitytracker.com/id/1032178 74255 http://www.securityfocus.com/bid/74255 DSA-3480 http://www.debian.org/security/2016/dsa-3480 FEDORA-2016-0480defc94 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html GLSA-201602-02 RHSA-2015:0863 https://rhn.redhat.com/errata/RHSA-2015-0863.html SUSE-SU-2015:1424 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html SUSE-SU-2016:0470 http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html USN-2985-1 http://www.ubuntu.com/usn/USN-2985-1 USN-2985-2 http://www.ubuntu.com/usn/USN-2985-2 [libc-alpha] 20150814 The GNU C Library version 2.22 is now available https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html https://sourceware.org/bugzilla/show_bug.cgi?id=18287 https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=2959eda9272a03386
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.