Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.4.2016.0748.1
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2016:0748-1)
Summary:The remote host is missing an update for the 'sles12sp1-docker-image' package(s) announced via the SUSE-SU-2016:0748-1 advisory.
Description:Summary:
The remote host is missing an update for the 'sles12sp1-docker-image' package(s) announced via the SUSE-SU-2016:0748-1 advisory.

Vulnerability Insight:
This update for sles12sp1-docker-image fixes the following issues:
glibc fixed the following security issues:
- CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed
remote attackers to cause a crash or execute arbitrary code via crafted
and timed DNS responses (bsc#961721)
- CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment
variable allowed local attackers to bypass the pointer guarding
protection of the dynamic loader on set-user-ID and set-group-ID
programs (bsc#950944)
- CVE-2015-8776: Out-of-range time values passed to the strftime function
may cause it to crash, leading to a denial of service, or potentially
disclosure information (bsc#962736)
- CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have
caused an out-of-bound memory access. leading to application crashes or,
potentially, arbitrary code execution (bsc#962737)
- CVE-2014-9761: A stack overflow (unbounded alloca) could have caused
applications which process long strings with the nan function to crash
or, potentially, execute arbitrary code. (bsc#962738)
- CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen
function could have caused applications which pass long strings to the
catopen function to crash or, potentially execute arbitrary code.
(bsc#962739)
glibc received the following non-security bugfixes:
- bsc#955647: Resource leak in resolver
- bsc#956716: Don't do lock elision on an error checking mutex
- bsc#958315: Reinitialize dl_load_write_lock on fork openssl fixed the following security issues:
- CVE-2016-0800 aka the 'DROWN' attack (bsc#968046): OpenSSL was
vulnerable to a cross-protocol attack that could lead to decryption of
TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites
as a Bleichenbacher RSA padding oracle.
This update changes the openssl library to:
* Disable SSLv2 protocol support by default.
This can be overridden by setting the environment variable
'OPENSSL_ALLOW_SSL2' or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag.
Note that various services and clients had already disabled SSL protocol 2 by default previously.
* Disable all weak EXPORT ciphers by default. These can be reenabled if
required by old legacy software using the environment variable
'OPENSSL_ALLOW_EXPORT'.
- CVE-2016-0702 aka the 'CacheBleed' attack. (bsc#968050) Various changes
in the modular exponentation code were added that make sure that it is
not possible to recover RSA secret keys by analyzing cache-bank
conflicts on the Intel Sandy-Bridge microarchitecture.
Note that this was only exploitable if the malicious code was running
on the same hyper threaded Intel Sandy Bridge processor as the victim
thread performing decryptions.
- CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser
code was fixed that could be abused to facilitate a denial-of-service
attack.
- CVE-2016-07... [Please see the references for more information on the vulnerabilities]

Affected Software/OS:
'sles12sp1-docker-image' package(s) on SUSE Linux Enterprise Module for Containers 12

Solution:
Please install the updated package(s).

CVSS Score:
10.0

CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2014-9761
BugTraq ID: 83306
http://www.securityfocus.com/bid/83306
Bugtraq: 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series (Google Search)
https://seclists.org/bugtraq/2019/Jun/14
Bugtraq: 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X (Google Search)
https://seclists.org/bugtraq/2019/Sep/7
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html
http://seclists.org/fulldisclosure/2019/Jun/18
http://seclists.org/fulldisclosure/2019/Sep/7
https://security.gentoo.org/glsa/201702-11
http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html
http://www.openwall.com/lists/oss-security/2016/01/19/11
http://www.openwall.com/lists/oss-security/2016/01/20/1
RedHat Security Advisories: RHSA-2017:0680
http://rhn.redhat.com/errata/RHSA-2017-0680.html
RedHat Security Advisories: RHSA-2017:1916
https://access.redhat.com/errata/RHSA-2017:1916
SuSE Security Announcement: SUSE-SU-2016:0470 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html
SuSE Security Announcement: SUSE-SU-2016:0471 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html
SuSE Security Announcement: SUSE-SU-2016:0472 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html
SuSE Security Announcement: SUSE-SU-2016:0473 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html
SuSE Security Announcement: openSUSE-SU-2016:0510 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html
http://www.ubuntu.com/usn/USN-2985-1
http://www.ubuntu.com/usn/USN-2985-2
Common Vulnerability Exposure (CVE) ID: CVE-2015-0293
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
BugTraq ID: 73232
http://www.securityfocus.com/bid/73232
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157177.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156823.html
FreeBSD Security Advisory: FreeBSD-SA-16:12
https://www.freebsd.org/security/advisories/FreeBSD-SA-15%3A06.openssl.asc
https://security.gentoo.org/glsa/201503-11
HPdes Security Advisory: HPSBMU03380
http://marc.info/?l=bugtraq&m=143748090628601&w=2
HPdes Security Advisory: HPSBMU03397
http://marc.info/?l=bugtraq&m=144050297101809&w=2
HPdes Security Advisory: HPSBMU03409
http://marc.info/?l=bugtraq&m=144050155601375&w=2
HPdes Security Advisory: HPSBUX03334
http://marc.info/?l=bugtraq&m=143213830203296&w=2
HPdes Security Advisory: SSRT102000
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
http://www.mandriva.com/security/advisories?name=MDVSA-2015:063
RedHat Security Advisories: RHSA-2015:0715
http://rhn.redhat.com/errata/RHSA-2015-0715.html
RedHat Security Advisories: RHSA-2015:0716
http://rhn.redhat.com/errata/RHSA-2015-0716.html
RedHat Security Advisories: RHSA-2015:0752
http://rhn.redhat.com/errata/RHSA-2015-0752.html
RedHat Security Advisories: RHSA-2015:0800
http://rhn.redhat.com/errata/RHSA-2015-0800.html
http://www.securitytracker.com/id/1031929
SuSE Security Announcement: SUSE-SU-2015:0541 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00022.html
SuSE Security Announcement: SUSE-SU-2015:0578 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
SuSE Security Announcement: SUSE-SU-2016:0617 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
SuSE Security Announcement: SUSE-SU-2016:0620 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
SuSE Security Announcement: SUSE-SU-2016:0621 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html
SuSE Security Announcement: SUSE-SU-2016:0624 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html
SuSE Security Announcement: SUSE-SU-2016:0631 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html
SuSE Security Announcement: SUSE-SU-2016:0641 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html
SuSE Security Announcement: SUSE-SU-2016:1057 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html
SuSE Security Announcement: openSUSE-SU-2015:0554 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-03/msg00062.html
SuSE Security Announcement: openSUSE-SU-2016:0628 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html
SuSE Security Announcement: openSUSE-SU-2016:0637 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
SuSE Security Announcement: openSUSE-SU-2016:0638 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html
SuSE Security Announcement: openSUSE-SU-2016:0640 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
SuSE Security Announcement: openSUSE-SU-2016:0720 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html
http://www.ubuntu.com/usn/USN-2537-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-3197
BugTraq ID: 82237
http://www.securityfocus.com/bid/82237
BugTraq ID: 91787
http://www.securityfocus.com/bid/91787
CERT/CC vulnerability note: VU#257823
https://www.kb.cert.org/vuls/id/257823
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:11.openssl.asc
https://security.gentoo.org/glsa/201601-05
http://www.securitytracker.com/id/1034849
SuSE Security Announcement: SUSE-SU-2016:0678 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html
SuSE Security Announcement: openSUSE-SU-2016:1239 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
SuSE Security Announcement: openSUSE-SU-2016:1241 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-7547
BugTraq ID: 83265
http://www.securityfocus.com/bid/83265
CERT/CC vulnerability note: VU#457759
https://www.kb.cert.org/vuls/id/457759
Debian Security Information: DSA-3480 (Google Search)
http://www.debian.org/security/2016/dsa-3480
Debian Security Information: DSA-3481 (Google Search)
http://www.debian.org/security/2016/dsa-3481
https://www.exploit-db.com/exploits/39454/
https://www.exploit-db.com/exploits/40339/
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177412.html
https://security.gentoo.org/glsa/201602-02
HPdes Security Advisory: HPSBGN03442
http://marc.info/?l=bugtraq&m=145690841819314&w=2
HPdes Security Advisory: HPSBGN03547
http://marc.info/?l=bugtraq&m=145596041017029&w=2
HPdes Security Advisory: HPSBGN03549
http://marc.info/?l=bugtraq&m=145672440608228&w=2
HPdes Security Advisory: HPSBGN03551
http://marc.info/?l=bugtraq&m=145857691004892&w=2
HPdes Security Advisory: HPSBGN03582
http://marc.info/?l=bugtraq&m=146161017210491&w=2
http://packetstormsecurity.com/files/135802/glibc-getaddrinfo-Stack-Based-Buffer-Overflow.html
https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://ics-cert.us-cert.gov/advisories/ICSA-16-103-01
https://www.tenable.com/security/research/tra-2017-08
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
RedHat Security Advisories: RHSA-2016:0175
http://rhn.redhat.com/errata/RHSA-2016-0175.html
RedHat Security Advisories: RHSA-2016:0176
http://rhn.redhat.com/errata/RHSA-2016-0176.html
RedHat Security Advisories: RHSA-2016:0225
http://rhn.redhat.com/errata/RHSA-2016-0225.html
RedHat Security Advisories: RHSA-2016:0277
http://rhn.redhat.com/errata/RHSA-2016-0277.html
http://www.securitytracker.com/id/1035020
SuSE Security Announcement: openSUSE-SU-2016:0511 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00043.html
SuSE Security Announcement: openSUSE-SU-2016:0512 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00044.html
http://ubuntu.com/usn/usn-2900-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-8776
BugTraq ID: 83277
http://www.securityfocus.com/bid/83277
Common Vulnerability Exposure (CVE) ID: CVE-2015-8777
BugTraq ID: 81469
http://www.securityfocus.com/bid/81469
http://hmarco.org/bugs/glibc_ptr_mangle_weakness.html
http://www.securitytracker.com/id/1034811
Common Vulnerability Exposure (CVE) ID: CVE-2015-8778
BugTraq ID: 83275
http://www.securityfocus.com/bid/83275
Common Vulnerability Exposure (CVE) ID: CVE-2015-8779
BugTraq ID: 82244
http://www.securityfocus.com/bid/82244
Common Vulnerability Exposure (CVE) ID: CVE-2016-0702
Cisco Security Advisory: 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl
Debian Security Information: DSA-3500 (Google Search)
http://www.debian.org/security/2016/dsa-3500
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178358.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178817.html
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc
https://security.gentoo.org/glsa/201603-15
HPdes Security Advisory: HPSBGN03563
http://marc.info/?l=bugtraq&m=145889460330120&w=2
http://cachebleed.info
RedHat Security Advisories: RHSA-2016:2957
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.securitytracker.com/id/1035133
SuSE Security Announcement: SUSE-SU-2016:1267 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
SuSE Security Announcement: SUSE-SU-2016:1290 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
SuSE Security Announcement: SUSE-SU-2016:1360 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
SuSE Security Announcement: openSUSE-SU-2016:0627 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.html
SuSE Security Announcement: openSUSE-SU-2016:1242 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
SuSE Security Announcement: openSUSE-SU-2016:1273 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
SuSE Security Announcement: openSUSE-SU-2016:1566 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
http://www.ubuntu.com/usn/USN-2914-1
Common Vulnerability Exposure (CVE) ID: CVE-2016-0703
BugTraq ID: 83743
http://www.securityfocus.com/bid/83743
https://drownattack.com
Common Vulnerability Exposure (CVE) ID: CVE-2016-0704
BugTraq ID: 83764
http://www.securityfocus.com/bid/83764
Common Vulnerability Exposure (CVE) ID: CVE-2016-0705
BugTraq ID: 83754
http://www.securityfocus.com/bid/83754
HPdes Security Advisory: HPSBGN03569
http://marc.info/?l=bugtraq&m=145983526810210&w=2
HPdes Security Advisory: HPSBMU03575
http://marc.info/?l=bugtraq&m=146108058503441&w=2
RedHat Security Advisories: RHSA-2018:2568
https://access.redhat.com/errata/RHSA-2018:2568
RedHat Security Advisories: RHSA-2018:2575
https://access.redhat.com/errata/RHSA-2018:2575
RedHat Security Advisories: RHSA-2018:2713
https://access.redhat.com/errata/RHSA-2018:2713
SuSE Security Announcement: openSUSE-SU-2016:1332 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html
Common Vulnerability Exposure (CVE) ID: CVE-2016-0797
BugTraq ID: 83763
http://www.securityfocus.com/bid/83763
Common Vulnerability Exposure (CVE) ID: CVE-2016-0798
BugTraq ID: 83705
http://www.securityfocus.com/bid/83705
Common Vulnerability Exposure (CVE) ID: CVE-2016-0799
BugTraq ID: 83755
http://www.securityfocus.com/bid/83755
RedHat Security Advisories: RHSA-2016:0722
http://rhn.redhat.com/errata/RHSA-2016-0722.html
RedHat Security Advisories: RHSA-2016:0996
http://rhn.redhat.com/errata/RHSA-2016-0996.html
RedHat Security Advisories: RHSA-2016:2073
http://rhn.redhat.com/errata/RHSA-2016-2073.html
Common Vulnerability Exposure (CVE) ID: CVE-2016-0800
BugTraq ID: 83733
http://www.securityfocus.com/bid/83733
CERT/CC vulnerability note: VU#583776
https://www.kb.cert.org/vuls/id/583776
HPdes Security Advisory: HPSBMU03573
http://marc.info/?l=bugtraq&m=146133665209436&w=2
https://ics-cert.us-cert.gov/advisories/ICSA-16-103-03
RedHat Security Advisories: RHSA-2016:1519
http://rhn.redhat.com/errata/RHSA-2016-1519.html
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.