[Bug 1584392] CVE-2018-1002200 plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1584392
Joshua Padman <jpadman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|80605,reported=20180529,sou |80605,reported=20180529,sou
|rce=researcher,cvss3=7.3/CV |rce=researcher,cvss3=7.3/CV
|SS:3.0/AV:N/AC:L/PR:N/UI:N/ |SS:3.0/AV:N/AC:L/PR:N/UI:N/
|S:U/C:L/I:L/A:L,cwe=CWE-22, |S:U/C:L/I:L/A:L,cwe=CWE-22,
|rhscl-3/rh-maven33-plexus-a |rhscl-3/rh-maven33-plexus-a
|rchiver=affected,rhel-7/ple |rchiver=affected,rhel-7/ple
|xus-archiver=affected,rhel- |xus-archiver=affected,rhel-
|8/plexus-archiver=affected, |8/plexus-archiver=affected,
|fedora-27/plexus-archiver=a |fedora-27/plexus-archiver=a
|ffected,fedora-28/plexus-ar |ffected,fedora-28/plexus-ar
|chiver=affected,fis-2/plexu |chiver=affected,fis-2/plexu
|s-archiver=affected,jbds-9/ |s-archiver=affected,jbds-9/
|plexus-archiver=notaffected |plexus-archiver=notaffected
|,openstack-9/opendaylight=w |,openstack-9/opendaylight=w
|ontfix,rhscl-3/rh-maven35-p |ontfix/impact=low,rhscl-3/r
|lexus-archiver=affected |h-maven35-plexus-archiver=a
| |ffected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1618573] CVE-2018-11771 apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1618573
Joshua Padman <jpadman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0817,reported=20180816,sour |0817,reported=20180816,sour
|ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:R/S:U |3.0/AV:N/AC:L/PR:N/UI:R/S:U
|/C:N/I:N/A:L,cwe=CWE-400,fe |/C:N/I:N/A:L,cwe=CWE-400,fe
|dora-all/apache-commons-com |dora-all/apache-commons-com
|press=affected,rhel-8/apach |press=affected,rhel-8/apach
|e-commons-compress=affected |e-commons-compress=affected
|,rhel-7/apache-commons-comp |,rhel-7/apache-commons-comp
|ress=new,rhev-m-4/apache-co |ress=new,rhev-m-4/apache-co
|mmons-compress=new,rhscl-3/ |mmons-compress=new,rhscl-3/
|rh-java-common-apache-commo |rh-java-common-apache-commo
|ns-compress=new,rhscl-3/rh- |ns-compress=new,rhscl-3/rh-
|maven35-apache-commons-comp |maven35-apache-commons-comp
|ress=new,rhmap-4/commons-co |ress=new,rhmap-4/commons-co
|mpress=new,rhes-3/commons-c |mpress=new,rhes-3/commons-c
|ompress=new,fsw-6/commons-c |ompress=new,fsw-6/commons-c
|ompress=new,fuse-6/commons- |ompress=new,fuse-6/commons-
|compress=new,fuse-7/commons |compress=new,fuse-7/commons
|-compress=new,jbds-11/commo |-compress=new,jbds-11/commo
|ns-compress=new,jdv-6/commo |ns-compress=new,jdv-6/commo
|ns-compress=new,bpms-6/comm |ns-compress=new,bpms-6/comm
|ons-compress=new,brms-6/com |ons-compress=new,brms-6/com
|mons-compress=new,jon-3/com |mons-compress=new,jon-3/com
|mons-compress=new,openstack |mons-compress=new,openstack
|-8/opendaylight=affected/im |-8/opendaylight=wontfix,ope
|pact=low,openstack-9/openda |nstack-9/opendaylight=wontf
|ylight=affected/impact=low, |ix,rhn_satellite_6/commons-
|rhn_satellite_6/commons-com |compress=new
|press=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1584392] CVE-2018-1002200 plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1584392
Joshua Padman <jpadman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|80605,reported=20180529,sou |80605,reported=20180529,sou
|rce=researcher,cvss3=7.3/CV |rce=researcher,cvss3=7.3/CV
|SS:3.0/AV:N/AC:L/PR:N/UI:N/ |SS:3.0/AV:N/AC:L/PR:N/UI:N/
|S:U/C:L/I:L/A:L,cwe=CWE-22, |S:U/C:L/I:L/A:L,cwe=CWE-22,
|rhscl-3/rh-maven33-plexus-a |rhscl-3/rh-maven33-plexus-a
|rchiver=affected,rhel-7/ple |rchiver=affected,rhel-7/ple
|xus-archiver=affected,rhel- |xus-archiver=affected,rhel-
|8/plexus-archiver=affected, |8/plexus-archiver=affected,
|fedora-27/plexus-archiver=a |fedora-27/plexus-archiver=a
|ffected,fedora-28/plexus-ar |ffected,fedora-28/plexus-ar
|chiver=affected,fis-2/plexu |chiver=affected,fis-2/plexu
|s-archiver=affected,jbds-9/ |s-archiver=affected,jbds-9/
|plexus-archiver=notaffected |plexus-archiver=notaffected
|,openstack-9/opendaylight=a |,openstack-9/opendaylight=w
|ffected/impact=low,rhscl-3/ |ontfix,rhscl-3/rh-maven35-p
|rh-maven35-plexus-archiver= |lexus-archiver=affected
|affected |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1339320] New: CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1339320
Bug ID: 1339320
Summary: CVE-2016-3088 activemq: Fileserver web application
vulnerability allowing RCE [fedora-all]
Product: Fedora
Version: 23
Component: activemq
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: puntogil(a)libero.it
Reporter: amaris(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: agrimm(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, s(a)shk.io, tdawson(a)redhat.com
Blocks: 1339318 (CVE-2016-3088)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1339318
[Bug 1339318] CVE-2016-3088 activemq: Fileserver web application
vulnerability allowing RCE
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1339318] CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1339318
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|60524,reported=20160524,sou |60524,reported=20160524,sou
|rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N
|/AC:M/Au:N/C:P/I:P/A:P,cwe= |/AC:M/Au:N/C:P/I:P/A:P,cwe=
|CWE-22,amq-6/activemq=affec |CWE-22,amq-6/activemq=affec
|ted/impact=moderate,fuse-6/ |ted/impact=moderate,fuse-6/
|activemq=affected/impact=mo |activemq=affected/impact=mo
|derate,fsw-6/activemq=new,o |derate,fsw-6/activemq=affec
|penshift-enterprise-2/activ |ted,openshift-enterprise-2/
|emq=notaffected,openshift-1 |activemq=notaffected,opensh
|/activemq=affected,fedora-a |ift-1/activemq=affected,fed
|ll/activemq=affected |ora-all/activemq=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1339318] CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1339318
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |hghasemb(a)redhat.com
Whiteboard|impact=important,public=201 |impact=important,public=201
|60524,reported=20160524,sou |60524,reported=20160524,sou
|rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N
|/AC:M/Au:N/C:P/I:P/A:P,cwe= |/AC:M/Au:N/C:P/I:P/A:P,cwe=
|CWE-22,amq-6/activemq=affec |CWE-22,amq-6/activemq=affec
|ted/impact=moderate,fuse-6/ |ted/impact=moderate,fuse-6/
|activemq=affected/impact=mo |activemq=affected/impact=mo
|derate,fsw-6/activemq=affec |derate,fsw-6/activemq=new,o
|ted,openshift-enterprise-2/ |penshift-enterprise-2/activ
|activemq=notaffected,opensh |emq=notaffected,openshift-1
|ift-1/activemq=affected,fed |/activemq=affected,fedora-a
|ora-all/activemq=affected |ll/activemq=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1339318] CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1339318
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|60524,reported=20160524,sou |60524,reported=20160524,sou
|rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N
|/AC:M/Au:N/C:P/I:P/A:P,cwe= |/AC:M/Au:N/C:P/I:P/A:P,cwe=
|CWE-22,amq-6/activemq=affec |CWE-22,amq-6/activemq=affec
|ted/impact=moderate,fuse-6/ |ted/impact=moderate,fuse-6/
|activemq=affected/impact=mo |activemq=affected/impact=mo
|derate,fsw-6/activemq=new,o |derate,fsw-6/activemq=affec
|penshift-enterprise-2/activ |ted,openshift-enterprise-2/
|emq=notaffected,openshift-1 |activemq=notaffected,opensh
|/activemq=affected,fedora-a |ift-1/activemq=affected,fed
|ll/activemq=affected |ora-all/activemq=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1095077] New: exec-maven-plugin: enable test suite
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1095077
Bug ID: 1095077
Summary: exec-maven-plugin: enable test suite
Product: Fedora
Version: rawhide
Component: exec-maven-plugin
Assignee: msrb(a)redhat.com
Reporter: msrb(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem:
Test suite in exec-maven-plugin 1.3 is currently disabled, because all tests
are failing with following error:
testIsResultCodeAFailure(org.codehaus.mojo.exec.ExecMojoTest) Time elapsed:
0.039 sec <<< ERROR!
java.lang.NoSuchMethodError:
org.codehaus.plexus.ContainerConfiguration.setClassPathScanning(Ljava/lang/String;)Lorg/codehaus/plexus/ContainerConfiguration;
at
org.apache.maven.plugin.testing.AbstractMojoTestCase.setupContainerConfiguration(AbstractMojoTestCase.java:248)
at
org.apache.maven.plugin.testing.AbstractMojoTestCase.setupContainer(AbstractMojoTestCase.java:222)
at
org.apache.maven.plugin.testing.AbstractMojoTestCase.getContainer(AbstractMojoTestCase.java:261)
at
org.apache.maven.plugin.testing.AbstractMojoTestCase.setUp(AbstractMojoTestCase.java:115)
at org.codehaus.mojo.exec.ExecMojoTest.setUp(ExecMojoTest.java:90)
Version-Release number of selected component (if applicable):
1.3-1
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=XHBSB6Tddh&a=cc_unsubscribe
5 years, 6 months
[Bug 1597490] New: CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1597490
Bug ID: 1597490
Summary: CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java
allows for out of memory erros via crafted PDF
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lpetrovi(a)redhat.com, meissner(a)suse.de,
nwallace(a)redhat.com, orion(a)nwra.com,
paradhya(a)redhat.com, pszubiak(a)redhat.com,
puntogil(a)libero.it, rrajasek(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, vhalbert(a)redhat.com
PDFBox before versions 1.8.15 and 2.0.11 has an infinitre loop in
AFMParser.java. An attacker could exploit this to cause an out of memory error
via a crafted PDF.
External Reference:
http://www.openwall.com/lists/oss-security/2018/06/29/1
Upstream Release Notes:
https://www.apache.org/dist/pdfbox/2.0.11/RELEASE-NOTES.txt
https://www.apache.org/dist/pdfbox/1.8.15/RELEASE-NOTES.txt
Upstream Issue:
https://issues.apache.org/jira/projects/PDFBOX/issues/PDFBOX-4251
Upstream Patches:
http://svn.apache.org/viewvc/pdfbox/trunk/fontbox/src/main/java/org/apach...
http://svn.apache.org/viewvc/pdfbox/branches/2.0/fontbox/src/main/java/or...
http://svn.apache.org/viewvc/pdfbox/branches/1.8/fontbox/src/main/java/or...
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months