Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-7317
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T20:46:45.928Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "20190417 [slackware-security] libpng (SSA:2019-107-01)", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Apr/30" }, { "name": "DSA-4435", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4435" }, { "name": "20190429 [SECURITY] [DSA 4435-1] libpng1.6 security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Apr/36" }, { "name": "USN-3962-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/3962-1/" }, { "name": "USN-3991-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/3991-1/" }, { "name": "20190522 [slackware-security] mozilla-firefox (SSA:2019-141-01)", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/May/56" }, { "name": "20190523 [SECURITY] [DSA 4448-1] firefox-esr security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/May/59" }, { "name": "DSA-4448", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4448" }, { "name": "[debian-lts-announce] 20190523 [SECURITY] [DLA 1800-1] firefox-esr security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html" }, { "name": "RHSA-2019:1265", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "name": "RHSA-2019:1267", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "name": "RHSA-2019:1269", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "name": "DSA-4451", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1308", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "RHSA-2019:1309", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "openSUSE-SU-2019:1534", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "108098", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/108098" }, { "name": "USN-4080-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4080-1/" }, { "name": "USN-4083-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4083-1/" }, { "name": "GLSA-201908-02", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201908-02" }, { "name": "RHSA-2019:2494", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2494" }, { "name": "RHSA-2019:2495", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2495" }, { "name": "openSUSE-SU-2019:1916", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html" }, { "name": "openSUSE-SU-2019:1912", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html" }, { "name": "RHSA-2019:2585", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2585" }, { "name": "RHSA-2019:2590", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2590" }, { "name": "RHSA-2019:2592", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2592" }, { "name": "RHSA-2019:2737", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2737" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/glennrp/libpng/issues/275" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20190719-0005/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2019-02-04T00:00:00", "descriptions": [ { "lang": "en", "value": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-10-20T10:38:36", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "20190417 [slackware-security] libpng (SSA:2019-107-01)", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/Apr/30" }, { "name": "DSA-4435", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2019/dsa-4435" }, { "name": "20190429 [SECURITY] [DSA 4435-1] libpng1.6 security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/Apr/36" }, { "name": "USN-3962-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/3962-1/" }, { "name": "USN-3991-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/3991-1/" }, { "name": "20190522 [slackware-security] mozilla-firefox (SSA:2019-141-01)", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/May/56" }, { "name": "20190523 [SECURITY] [DSA 4448-1] firefox-esr security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/May/59" }, { "name": "DSA-4448", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2019/dsa-4448" }, { "name": "[debian-lts-announce] 20190523 [SECURITY] [DLA 1800-1] firefox-esr security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html" }, { "name": "RHSA-2019:1265", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "name": "RHSA-2019:1267", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "name": "RHSA-2019:1269", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "name": "DSA-4451", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1308", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "RHSA-2019:1309", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "openSUSE-SU-2019:1534", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "108098", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/108098" }, { "name": "USN-4080-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4080-1/" }, { "name": "USN-4083-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4083-1/" }, { "name": "GLSA-201908-02", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201908-02" }, { "name": "RHSA-2019:2494", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2494" }, { "name": "RHSA-2019:2495", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2495" }, { "name": "openSUSE-SU-2019:1916", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html" }, { "name": "openSUSE-SU-2019:1912", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html" }, { "name": "RHSA-2019:2585", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2585" }, { "name": "RHSA-2019:2590", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2590" }, { "name": "RHSA-2019:2592", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2592" }, { "name": "RHSA-2019:2737", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2737" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/glennrp/libpng/issues/275" }, { "tags": [ "x_refsource_MISC" ], "url": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20190719-0005/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-7317", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "20190417 [slackware-security] libpng (SSA:2019-107-01)", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Apr/30" }, { "name": "DSA-4435", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4435" }, { "name": "20190429 [SECURITY] [DSA 4435-1] libpng1.6 security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Apr/36" }, { "name": "USN-3962-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3962-1/" }, { "name": "USN-3991-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3991-1/" }, { "name": "20190522 [slackware-security] mozilla-firefox (SSA:2019-141-01)", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/56" }, { "name": "20190523 [SECURITY] [DSA 4448-1] firefox-esr security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/59" }, { "name": "DSA-4448", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4448" }, { "name": "[debian-lts-announce] 20190523 [SECURITY] [DLA 1800-1] firefox-esr security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html" }, { "name": "RHSA-2019:1265", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "name": "RHSA-2019:1267", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "name": "RHSA-2019:1269", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "name": "DSA-4451", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1308", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "RHSA-2019:1309", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "openSUSE-SU-2019:1534", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "108098", "refsource": "BID", "url": "http://www.securityfocus.com/bid/108098" }, { "name": "USN-4080-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4080-1/" }, { "name": "USN-4083-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4083-1/" }, { "name": "GLSA-201908-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201908-02" }, { "name": "RHSA-2019:2494", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2494" }, { "name": "RHSA-2019:2495", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2495" }, { "name": "openSUSE-SU-2019:1916", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html" }, { "name": "openSUSE-SU-2019:1912", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html" }, { "name": "RHSA-2019:2585", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2585" }, { "name": "RHSA-2019:2590", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2590" }, { "name": "RHSA-2019:2592", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2592" }, { "name": "RHSA-2019:2737", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2737" }, { "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "refsource": "MISC", "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803", "refsource": "MISC", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803" }, { "name": "https://github.com/glennrp/libpng/issues/275", "refsource": "MISC", "url": "https://github.com/glennrp/libpng/issues/275" }, { "name": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html" }, { "name": "https://security.netapp.com/advisory/ntap-20190719-0005/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190719-0005/" }, { "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us", "refsource": "CONFIRM", "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-7317", "datePublished": "2019-02-04T07:00:00", "dateReserved": "2019-02-04T00:00:00", "dateUpdated": "2024-08-04T20:46:45.928Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-7317\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-02-04T08:29:00.447\",\"lastModified\":\"2024-11-21T04:48:00.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n png_image_free en el archivo png.c en libpng versiones 1.6.x anteriores a 1.6.37, presenta un uso de la memoria previamente liberada porque la funci\u00f3n png_image_free_function es llamada bajo png_safe_execute.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:N/C:N/I:N/A:P\",\"baseScore\":2.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":4.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.6.0\",\"versionEndExcluding\":\"1.6.37\",\"matchCriteriaId\":\"078AA00A-515F-493E-A53E-FE1937FA8018\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"712507AC-DAB8-4FFE-9426-08282919411F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C312A0-CD2C-4B9C-B064-6409B25C278F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD783B0C-9246-47D9-A937-6144FE8BFF0F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C21D62F-F3DD-4E9E-B644-07CCC49F3D53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:java_se:7u221:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3999BDC1-BA77-4DBE-8041-D993BA9FF04D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:java_se:8u212:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2B2677D-6B48-45A2-8567-AB6DB9FF1B45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdk:11.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EAF3DD5E-1A96-4285-84BA-EB5E31EF2516\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdk:12.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32318CC6-B8C4-4429-BB8B-134DC202A27E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.0.23\",\"matchCriteriaId\":\"0185E85D-2C64-4D77-BC1D-A20165D5078E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*\",\"versionEndExcluding\":\"8.7.0-00\",\"matchCriteriaId\":\"6B07BDE2-FE50-4C0E-9C73-6AA6C1D6C060\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hpe:xp7_command_view_advanced_edition_suite:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.7.0-00\",\"matchCriteriaId\":\"BE33C1F1-DED8-424C-8942-E1A48A9EBA05\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97D4FFCF-5309-43B6-9FD5-680C6D535A7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF583CDC-DE9E-45AB-9861-CB203BFA8862\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1E78106-58E6-4D59-990F-75DA575BFAD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensuse:package_hub:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B8B0B75-0DF2-4B5C-BC81-2F8E172AEE4E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBC8B78D-1131-4F21-919D-8AC79A410FB9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*\",\"versionEndExcluding\":\"9.6\",\"matchCriteriaId\":\"60429DC5-C403-41D1-9DDF-30782D012DF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"9.6\",\"matchCriteriaId\":\"95571D2E-5C83-484C-A44F-AC36972C67D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:vmware_vsphere:*:*\",\"matchCriteriaId\":\"3AF659DD-C4AE-4DDC-B50B-327A717EFC74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:windows:*:*\",\"matchCriteriaId\":\"40E21C6E-AEDF-43E8-AA80-629C77D24DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C2089EE-5D7F-47EC-8EA5-0F69790564C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:vcenter:*:*\",\"matchCriteriaId\":\"BADA4949-F766-4092-A6BC-1B85B5FB60FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:e-series_santricity_storage_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.53\",\"matchCriteriaId\":\"1FC01AF8-4A4B-4FC4-B07F-1193FEFF5A47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:e-series_santricity_unified_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.2\",\"matchCriteriaId\":\"8557ED41-5B30-47C8-A556-6C1F6E8E227B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:*\",\"versionEndExcluding\":\"4.0\",\"matchCriteriaId\":\"C7E42333-853D-4938-90EB-2A6653476357\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.3.9\",\"matchCriteriaId\":\"82DC1F62-0DA2-4BB8-9AFE-4BC4366205F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.1\",\"matchCriteriaId\":\"2798786F-A818-4C52-BC20-0A69DB49D16A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFE0A9D2-9A49-4BF6-BC6F-8249162D8334\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*\",\"versionEndExcluding\":\"3.4.2\",\"matchCriteriaId\":\"41436638-0B88-4823-8208-81C01F2CA6A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*\",\"versionEndExcluding\":\"3.4.2\",\"matchCriteriaId\":\"910F5303-1F70-44E3-A951-567447BC46FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:oracle:*:*\",\"matchCriteriaId\":\"1925AC26-45D4-46D5-ACDD-91E5A90977B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:sap:*:*\",\"matchCriteriaId\":\"9DC6435A-8369-4D18-A6EE-84E73D6AA84D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DF5449D-22D2-48B4-8F50-57B43DCB15B9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4F86C3C-B99C-44C6-97D7-163DC3F59687\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33C068A4-3780-4EAB-A937-6082DF847564\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5291B60-AB52-4830-8E1A-8048A471902C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"566507B6-AC95-47F7-A3FB-C6F414E45F51\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87C21FE1-EA5C-498F-9C6C-D05F91A88217\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25C8B513-76C1-4184-A253-CB32F04A05BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CDCFF34-6F1D-45A1-BE37-6A0E17B04801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4A684C7-88FD-43C4-9BDB-AE337FCBD0AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47811209-5CE5-4375-8391-B0A7F6A0E420\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"634C23AC-AC9C-43F4-BED8-1C720816D5E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37CE1DC7-72C5-483C-8921-0B462C8284D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5ED5807-55B7-47C5-97A6-03233F4FBC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/108098\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1265\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1267\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1269\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1308\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1309\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1310\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2494\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2495\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2585\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2590\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2592\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2737\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/glennrp/libpng/issues/275\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Apr/30\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Apr/36\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/May/56\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/May/59\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/May/67\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201908-02\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20190719-0005/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3962-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3991-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3997-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4080-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4083-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4435\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4448\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4451\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/108098\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1265\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1267\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1269\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1308\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1309\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1310\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2494\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2495\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2585\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2590\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2592\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2737\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/glennrp/libpng/issues/275\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Apr/30\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Apr/36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/May/56\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/May/59\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/May/67\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201908-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20190719-0005/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3962-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3991-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3997-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4080-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4083-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4435\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4448\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4451\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}" } }
ghsa-m96g-x499-p5f9
Vulnerability from github
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
{ "affected": [], "aliases": [ "CVE-2019-7317" ], "database_specific": { "cwe_ids": [ "CWE-416" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2019-02-04T08:29:00Z", "severity": "MODERATE" }, "details": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "id": "GHSA-m96g-x499-p5f9", "modified": "2022-04-30T00:02:15Z", "published": "2022-04-30T00:02:15Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" }, { "type": "WEB", "url": "https://github.com/glennrp/libpng/issues/275" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/May/56" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/May/59" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/May/67" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201908-02" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20190719-0005" }, { "type": "WEB", "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us" }, { "type": "WEB", "url": "https://usn.ubuntu.com/3962-1" }, { "type": "WEB", "url": "https://usn.ubuntu.com/3991-1" }, { "type": "WEB", "url": "https://usn.ubuntu.com/3997-1" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4080-1" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4083-1" }, { "type": "WEB", "url": "https://www.debian.org/security/2019/dsa-4435" }, { "type": "WEB", "url": "https://www.debian.org/security/2019/dsa-4448" }, { "type": "WEB", "url": "https://www.debian.org/security/2019/dsa-4451" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2494" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2495" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2585" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2590" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2592" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2737" }, { "type": "WEB", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/Apr/30" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/Apr/36" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/108098" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ] }
rhsa-2019_2590
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 8 to version 8 SR5-FP40.\n\nSecurity Fix(es):\n\n* IBM JDK: Out-of-bounds access in the String.getBytes method (CVE-2019-11772)\n\n* IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)\n\n* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)\n\n* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)\n\n* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)\n\n* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2590", "url": "https://access.redhat.com/errata/RHSA-2019:2590" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2590.json" } ], "title": "Red Hat Security Advisory: java-1.8.0-ibm security update", "tracking": { "current_release_date": "2024-11-15T08:25:50+00:00", "generator": { "date": "2024-11-15T08:25:50+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2590", "initial_release_date": "2019-09-02T07:46:18+00:00", "revision_history": [ { "date": "2019-09-02T07:46:18+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-09-02T07:46:18+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T08:25:50+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 8 Supplementary", "product": { "name": "Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::supplementary" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-headless@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-plugin@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "product": { "name": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "product_id": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-webstart@1.8.0.5.40-3.el8_0?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-3.el8_0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-3.el8_0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-3.el8_0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "product": { "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "product_id": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-headless@1.8.0.5.40-3.el8_0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-3.el8_0?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-3.el8_0?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-headless@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-plugin@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64", "product": { "name": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64", "product_id": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-webstart@1.8.0.5.40-3.el8_0?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x" }, "product_reference": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le" }, "product_reference": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "relates_to_product_reference": "Supplementary-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64 as a component of Red Hat Enterprise Linux 8 Supplementary", "product_id": "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" }, "product_reference": "java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64", "relates_to_product_reference": "Supplementary-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-2762", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730415" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2762" }, { "category": "external", "summary": "RHBZ#1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2762", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2762" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:46:18+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2590" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)" }, { "cve": "CVE-2019-2769", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730056" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2769" }, { "category": "external", "summary": "RHBZ#1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:46:18+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2590" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)" }, { "cve": "CVE-2019-2786", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730255" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2786" }, { "category": "external", "summary": "RHBZ#1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2786", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2786" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:46:18+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2590" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)" }, { "cve": "CVE-2019-2816", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730099" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Missing URL format validation (Networking, 8221518)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2816" }, { "category": "external", "summary": "RHBZ#1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:46:18+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2590" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Missing URL format validation (Networking, 8221518)" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:46:18+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2590" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "cve": "CVE-2019-11772", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738547" } ], "notes": [ { "category": "description", "text": "In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Out-of-bounds access in the String.getBytes method", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11772" }, { "category": "external", "summary": "RHBZ#1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11772", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11772" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:46:18+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2590" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Out-of-bounds access in the String.getBytes method" }, { "cve": "CVE-2019-11775", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738549" } ], "notes": [ { "category": "description", "text": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Failure to privatize a value pulled out of the loop by versioning", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11775" }, { "category": "external", "summary": "RHBZ#1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11775", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:46:18+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2590" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-headless-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.s390x", "Supplementary-8.0.0.Z:java-1.8.0-ibm-src-1:1.8.0.5.40-3.el8_0.x86_64", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.ppc64le", "Supplementary-8.0.0.Z:java-1.8.0-ibm-webstart-1:1.8.0.5.40-3.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Failure to privatize a value pulled out of the loop by versioning" } ] }
rhsa-2019_2494
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 7 to version 7R1 SR4-FP50.\n\nSecurity Fix(es):\n\n* IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)\n\n* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)\n\n* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)\n\n* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2494", "url": "https://access.redhat.com/errata/RHSA-2019:2494" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2494.json" } ], "title": "Red Hat Security Advisory: java-1.7.1-ibm security update", "tracking": { "current_release_date": "2024-11-15T08:25:26+00:00", "generator": { "date": "2024-11-15T08:25:26+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2494", "initial_release_date": "2019-08-15T09:04:10+00:00", "revision_history": [ { "date": "2019-08-15T09:04:10+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-08-15T09:04:10+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T08:25:26+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_id": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-plugin@1.7.1.4.50-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_id": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-plugin@1.7.1.4.50-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-2762", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730415" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2762" }, { "category": "external", "summary": "RHBZ#1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2762", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2762" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:04:10+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2494" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)" }, { "cve": "CVE-2019-2769", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730056" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2769" }, { "category": "external", "summary": "RHBZ#1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:04:10+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2494" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)" }, { "cve": "CVE-2019-2816", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730099" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Missing URL format validation (Networking, 8221518)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2816" }, { "category": "external", "summary": "RHBZ#1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:04:10+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2494" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Missing URL format validation (Networking, 8221518)" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:04:10+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2494" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "cve": "CVE-2019-11775", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738549" } ], "notes": [ { "category": "description", "text": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Failure to privatize a value pulled out of the loop by versioning", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11775" }, { "category": "external", "summary": "RHBZ#1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11775", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:04:10+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2494" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Failure to privatize a value pulled out of the loop by versioning" } ] }
rhsa-2019_1308
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1308", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1308.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T13:19:49+00:00", "generator": { "date": "2024-11-22T13:19:49+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1308", "initial_release_date": "2019-06-03T20:52:39+00:00", "revision_history": [ { "date": "2019-06-03T20:52:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:52:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:49+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.src", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.src", "product_id": "thunderbird-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_2737
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.8.0-ibm is now available for Red Hat Satellite 5.8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 8 to version 8 SR5-FP40.\n\nSecurity Fix(es):\n\n* IBM JDK: Out-of-bounds access in the String.getBytes method (CVE-2019-11772)\n\n* IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)\n\n* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)\n\n* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)\n\n* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)\n\n* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2737", "url": "https://access.redhat.com/errata/RHSA-2019:2737" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2737.json" } ], "title": "Red Hat Security Advisory: java-1.8.0-ibm security update", "tracking": { "current_release_date": "2024-11-15T08:26:28+00:00", "generator": { "date": "2024-11-15T08:26:28+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2737", "initial_release_date": "2019-09-11T15:15:17+00:00", "revision_history": [ { "date": "2019-09-11T15:15:17+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-09-11T15:15:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T08:26:28+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Satellite 5.8 (RHEL v.6)", "product": { "name": "Red Hat Satellite 5.8 (RHEL v.6)", "product_id": "6Server-Satellite58", "product_identification_helper": { "cpe": "cpe:/a:redhat:network_satellite:5.8::el6" } } } ], "category": "product_family", "name": "Red Hat Satellite" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Satellite 5.8 (RHEL v.6)", "product_id": "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Satellite58" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Satellite 5.8 (RHEL v.6)", "product_id": "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Satellite58" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Satellite 5.8 (RHEL v.6)", "product_id": "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Satellite58" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Satellite 5.8 (RHEL v.6)", "product_id": "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Satellite58" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-2762", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730415" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2762" }, { "category": "external", "summary": "RHBZ#1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2762", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2762" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-11T15:15:17+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2737" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)" }, { "cve": "CVE-2019-2769", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730056" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2769" }, { "category": "external", "summary": "RHBZ#1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-11T15:15:17+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2737" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)" }, { "cve": "CVE-2019-2786", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730255" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2786" }, { "category": "external", "summary": "RHBZ#1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2786", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2786" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-11T15:15:17+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2737" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)" }, { "cve": "CVE-2019-2816", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730099" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Missing URL format validation (Networking, 8221518)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2816" }, { "category": "external", "summary": "RHBZ#1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-11T15:15:17+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2737" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Missing URL format validation (Networking, 8221518)" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-11T15:15:17+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2737" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "cve": "CVE-2019-11772", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738547" } ], "notes": [ { "category": "description", "text": "In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Out-of-bounds access in the String.getBytes method", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11772" }, { "category": "external", "summary": "RHBZ#1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11772", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11772" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-11T15:15:17+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2737" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Out-of-bounds access in the String.getBytes method" }, { "cve": "CVE-2019-11775", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738549" } ], "notes": [ { "category": "description", "text": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Failure to privatize a value pulled out of the loop by versioning", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11775" }, { "category": "external", "summary": "RHBZ#1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11775", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-11T15:15:17+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2737" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Satellite58:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Failure to privatize a value pulled out of the loop by versioning" } ] }
rhsa-2019_2592
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 8 to version 8 SR5-FP40.\n\nSecurity Fix(es):\n\n* IBM JDK: Out-of-bounds access in the String.getBytes method (CVE-2019-11772)\n\n* IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)\n\n* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)\n\n* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)\n\n* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)\n\n* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2592", "url": "https://access.redhat.com/errata/RHSA-2019:2592" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2592.json" } ], "title": "Red Hat Security Advisory: java-1.8.0-ibm security update", "tracking": { "current_release_date": "2024-11-15T08:25:37+00:00", "generator": { "date": "2024-11-15T08:25:37+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2592", "initial_release_date": "2019-09-03T00:27:15+00:00", "revision_history": [ { "date": "2019-09-03T00:27:15+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-09-03T00:27:15+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T08:25:37+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_id": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-plugin@1.8.0.5.40-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el6_10?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-plugin@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el6_10?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el6_10?arch=ppc64\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el6_10?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-2762", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730415" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2762" }, { "category": "external", "summary": "RHBZ#1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2762", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2762" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-03T00:27:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2592" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)" }, { "cve": "CVE-2019-2769", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730056" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2769" }, { "category": "external", "summary": "RHBZ#1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-03T00:27:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2592" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)" }, { "cve": "CVE-2019-2786", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730255" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2786" }, { "category": "external", "summary": "RHBZ#1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2786", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2786" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-03T00:27:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2592" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)" }, { "cve": "CVE-2019-2816", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730099" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Missing URL format validation (Networking, 8221518)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2816" }, { "category": "external", "summary": "RHBZ#1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-03T00:27:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2592" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Missing URL format validation (Networking, 8221518)" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-03T00:27:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2592" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "cve": "CVE-2019-11772", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738547" } ], "notes": [ { "category": "description", "text": "In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Out-of-bounds access in the String.getBytes method", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11772" }, { "category": "external", "summary": "RHBZ#1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11772", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11772" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-03T00:27:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2592" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Out-of-bounds access in the String.getBytes method" }, { "cve": "CVE-2019-11775", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738549" } ], "notes": [ { "category": "description", "text": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Failure to privatize a value pulled out of the loop by versioning", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11775" }, { "category": "external", "summary": "RHBZ#1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11775", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-03T00:27:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2592" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Client-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6ComputeNode-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Server-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.i686", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.ppc64", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.s390x", "6Workstation-Supplementary-6.10.z:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Failure to privatize a value pulled out of the loop by versioning" } ] }
rhsa-2019_1310
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1310", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1310.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T13:20:02+00:00", "generator": { "date": "2024-11-22T13:20:02+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1310", "initial_release_date": "2019-06-03T20:55:59+00:00", "revision_history": [ { "date": "2019-06-03T20:55:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:20:02+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.src", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.src", "product_id": "thunderbird-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1267
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1267", "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1267.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T13:19:41+00:00", "generator": { "date": "2024-11-22T13:19:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1267", "initial_release_date": "2019-05-23T15:53:40+00:00", "revision_history": [ { "date": "2019-05-23T15:53:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:53:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-0:60.7.0-1.el6_10.i686", "product_id": "firefox-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.src", "product": { "name": "firefox-0:60.7.0-1.el6_10.src", "product_id": "firefox-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1265
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1265", "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1265.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T13:19:35+00:00", "generator": { "date": "2024-11-22T13:19:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1265", "initial_release_date": "2019-05-23T15:42:35+00:00", "revision_history": [ { "date": "2019-05-23T15:42:35+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:42:35+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.src", "product": { "name": "firefox-0:60.7.0-1.el7_6.src", "product_id": "firefox-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-0:60.7.0-1.el7_6.i686", "product_id": "firefox-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1269
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1269", "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1269.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T13:19:29+00:00", "generator": { "date": "2024-11-22T13:19:29+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1269", "initial_release_date": "2019-05-23T16:08:37+00:00", "revision_history": [ { "date": "2019-05-23T16:08:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T16:08:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:29+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.src", "product": { "name": "firefox-0:60.7.0-1.el8_0.src", "product_id": "firefox-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src" }, "product_reference": "firefox-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1309
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1309", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1309.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T13:19:55+00:00", "generator": { "date": "2024-11-22T13:19:55+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1309", "initial_release_date": "2019-06-03T20:55:50+00:00", "revision_history": [ { "date": "2019-06-03T20:55:50+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:50+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:55+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.src", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.src", "product_id": "thunderbird-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_2585
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 7 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 8 to version 8 SR5-FP40.\n\nSecurity Fix(es):\n\n* IBM JDK: Out-of-bounds access in the String.getBytes method (CVE-2019-11772)\n\n* IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)\n\n* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)\n\n* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)\n\n* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)\n\n* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2585", "url": "https://access.redhat.com/errata/RHSA-2019:2585" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2585.json" } ], "title": "Red Hat Security Advisory: java-1.8.0-ibm security update", "tracking": { "current_release_date": "2024-11-15T08:25:43+00:00", "generator": { "date": "2024-11-15T08:25:43+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2585", "initial_release_date": "2019-09-02T07:20:17+00:00", "revision_history": [ { "date": "2019-09-02T07:20:17+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-09-02T07:20:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T08:25:43+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-plugin@1.8.0.5.40-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el7?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_id": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-plugin@1.8.0.5.40-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_id": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm@1.8.0.5.40-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_id": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-demo@1.8.0.5.40-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_id": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-devel@1.8.0.5.40-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_id": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-jdbc@1.8.0.5.40-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_id": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.8.0-ibm-src@1.8.0.5.40-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" }, "product_reference": "java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-2762", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730415" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2762" }, { "category": "external", "summary": "RHBZ#1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2762", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2762" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:20:17+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2585" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)" }, { "cve": "CVE-2019-2769", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730056" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2769" }, { "category": "external", "summary": "RHBZ#1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:20:17+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2585" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)" }, { "cve": "CVE-2019-2786", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730255" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2786" }, { "category": "external", "summary": "RHBZ#1730255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730255" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2786", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2786" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2786" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:20:17+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2585" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)" }, { "cve": "CVE-2019-2816", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730099" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Missing URL format validation (Networking, 8221518)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2816" }, { "category": "external", "summary": "RHBZ#1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:20:17+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2585" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Missing URL format validation (Networking, 8221518)" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:20:17+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2585" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "cve": "CVE-2019-11772", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738547" } ], "notes": [ { "category": "description", "text": "In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Out-of-bounds access in the String.getBytes method", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11772" }, { "category": "external", "summary": "RHBZ#1738547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738547" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11772", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11772" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11772" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:20:17+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2585" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Out-of-bounds access in the String.getBytes method" }, { "cve": "CVE-2019-11775", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738549" } ], "notes": [ { "category": "description", "text": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Failure to privatize a value pulled out of the loop by versioning", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11775" }, { "category": "external", "summary": "RHBZ#1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11775", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-09-02T07:20:17+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2585" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-jdbc-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-plugin-1:1.8.0.5.40-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.8.0-ibm-src-1:1.8.0.5.40-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Failure to privatize a value pulled out of the loop by versioning" } ] }
rhsa-2019_2495
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 7 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 7 to version 7R1 SR4-FP50.\n\nSecurity Fix(es):\n\n* IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)\n\n* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)\n\n* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)\n\n* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2495", "url": "https://access.redhat.com/errata/RHSA-2019:2495" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2495.json" } ], "title": "Red Hat Security Advisory: java-1.7.1-ibm security update", "tracking": { "current_release_date": "2024-11-15T08:25:18+00:00", "generator": { "date": "2024-11-15T08:25:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2495", "initial_release_date": "2019-08-15T09:02:07+00:00", "revision_history": [ { "date": "2019-08-15T09:02:07+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-08-15T09:02:07+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T08:25:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:7" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_id": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-plugin@1.7.1.4.50-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el7?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el7?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el7?arch=ppc64\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_id": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm@1.7.1.4.50-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_id": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-demo@1.7.1.4.50-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_id": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-devel@1.7.1.4.50-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_id": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-jdbc@1.7.1.4.50-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_id": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-1.7.1-ibm-src@1.7.1.4.50-1jpp.1.el7?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Client Supplementary (v. 7)", "product_id": "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Client-7.7.Z-Client" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)", "product_id": "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7.Z-ComputeNode" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 7)", "product_id": "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Server-7.7.Z-Server" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 7)", "product_id": "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" }, "product_reference": "java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7.Z-Workstation" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-2762", "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730415" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2762" }, { "category": "external", "summary": "RHBZ#1730415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730415" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2762", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2762" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2762" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:02:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2495" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)" }, { "cve": "CVE-2019-2769", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730056" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2769" }, { "category": "external", "summary": "RHBZ#1730056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730056" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2769" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:02:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2495" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)" }, { "cve": "CVE-2019-2816", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-07-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1730099" } ], "notes": [ { "category": "description", "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).", "title": "Vulnerability description" }, { "category": "summary", "text": "OpenJDK: Missing URL format validation (Networking, 8221518)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-2816" }, { "category": "external", "summary": "RHBZ#1730099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730099" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-2816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2816" } ], "release_date": "2019-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:02:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2495" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "OpenJDK: Missing URL format validation (Networking, 8221518)" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:02:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2495" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "cve": "CVE-2019-11775", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1738549" } ], "notes": [ { "category": "description", "text": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.", "title": "Vulnerability description" }, { "category": "summary", "text": "JDK: Failure to privatize a value pulled out of the loop by versioning", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11775" }, { "category": "external", "summary": "RHBZ#1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11775", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11775" } ], "release_date": "2019-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-15T09:02:07+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of IBM Java must be restarted for this update to take effect.", "product_ids": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2495" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Client-7.7.Z-Client:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7ComputeNode-7.7.Z-ComputeNode:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Server-7.7.Z-Server:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-jdbc-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-plugin-1:1.7.1.4.50-1jpp.1.el7.x86_64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.ppc64le", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.s390x", "7Workstation-7.7.Z-Workstation:java-1.7.1-ibm-src-1:1.7.1.4.50-1jpp.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JDK: Failure to privatize a value pulled out of the loop by versioning" } ] }
wid-sec-w-2023-0122
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Die Oracle Supply Chain ist eine Sammlung von Applikationen f\u00fcr verschiedene Zwecke.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0122 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0122.json" }, { "category": "self", "summary": "WID-SEC-2023-0122 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0122" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Supply Chain vom 2023-01-17", "url": "https://www.oracle.com/security-alerts/cpujan2023.html#AppendixSCP" } ], "source_lang": "en-US", "title": "Oracle Supply Chain: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-01-17T23:00:00.000+00:00", "generator": { "date": "2024-08-15T17:41:43.641+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-0122", "initial_release_date": "2023-01-17T23:00:00.000+00:00", "revision_history": [ { "date": "2023-01-17T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Supply Chain 9.3.6", "product": { "name": "Oracle Supply Chain 9.3.6", "product_id": "T019052", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:9.3.6" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.1", "product": { "name": "Oracle Supply Chain 12.1", "product_id": "T019054", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.1" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.2", "product": { "name": "Oracle Supply Chain 12.2", "product_id": "T019055", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.2" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.2.11", "product": { "name": "Oracle Supply Chain 12.2.11", "product_id": "T021721", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.2.11" } } }, { "category": "product_name", "name": "Oracle Supply Chain \u003c 21.0.2.6", "product": { "name": "Oracle Supply Chain \u003c 21.0.2.6", "product_id": "T025892", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:21.0.2.6" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.2.7", "product": { "name": "Oracle Supply Chain 12.2.7", "product_id": "T025893", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.2.7" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.2.8", "product": { "name": "Oracle Supply Chain 12.2.8", "product_id": "T025894", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.2.8" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.2.9", "product": { "name": "Oracle Supply Chain 12.2.9", "product_id": "T025895", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.2.9" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.2.10", "product": { "name": "Oracle Supply Chain 12.2.10", "product_id": "T025896", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.2.10" } } }, { "category": "product_name", "name": "Oracle Supply Chain 12.2.12", "product": { "name": "Oracle Supply Chain 12.2.12", "product_id": "T025897", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:12.2.12" } } }, { "category": "product_name", "name": "Oracle Supply Chain \u003c 21.0.2.0", "product": { "name": "Oracle Supply Chain \u003c 21.0.2.0", "product_id": "T025898", "product_identification_helper": { "cpe": "cpe:/a:oracle:supply_chain:21.0.2.0" } } } ], "category": "product_name", "name": "Supply Chain" } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-21850", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2023-21850" }, { "cve": "CVE-2022-42252", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2022-42252" }, { "cve": "CVE-2022-34169", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2022-34169" }, { "cve": "CVE-2022-24839", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2022-24839" }, { "cve": "CVE-2021-44832", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2021-44832" }, { "cve": "CVE-2020-27844", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2020-27844" }, { "cve": "CVE-2019-7317", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2019-7317" }, { "cve": "CVE-2019-12415", "notes": [ { "category": "description", "text": "In Oracle Supply Chain existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T021721", "T019052", "T025895", "T025894", "T019054", "T025897", "T025896", "T019055", "T025893" ] }, "release_date": "2023-01-17T23:00:00.000+00:00", "title": "CVE-2019-12415" } ] }
wid-sec-w-2023-0065
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "MySQL ist ein Open Source Datenbankserver von Oracle.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0065 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2023-0065.json" }, { "category": "self", "summary": "WID-SEC-2023-0065 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0065" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALASMARIADB10.5-2023-004 vom 2023-09-27", "url": "https://alas.aws.amazon.com/AL2/ALASMARIADB10.5-2023-004.html" }, { "category": "external", "summary": "MariaDB 10.2.38 Release Notes", "url": "https://mariadb.com/kb/en/mdb-10238-rn/" }, { "category": "external", "summary": "MariaDB 10.3.29 Release Notes", "url": "https://mariadb.com/kb/en/mariadb-10329-release-notes/" }, { "category": "external", "summary": "MariaDB 10.5.10 Release Notes", "url": "https://mariadb.com/kb/en/mariadb-10510-release-notes/" }, { "category": "external", "summary": "MariaDB 10.4.19 Release Notes", "url": "https://mariadb.com/kb/en/mariadb-10419-release-notes/" }, { "category": "external", "summary": "Ubuntu Security Notice USN-4952-1 vom 2021-05-14", "url": "https://ubuntu.com/security/notices/USN-4952-1" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-202105-14 vom 2021-05-19", "url": "https://www.cybersecurity-help.cz/vdb/SB2021051922" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - April 2021 - Appendix Oracle MySQL vom 2021-04-20", "url": "https://www.oracle.com/security-alerts/cpuapr2021.html#AppendixMSQL" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202105-27 vom 2021-05-26", "url": "https://security.gentoo.org/glsa/202105-27" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:2605-1 vom 2021-08-04", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-August/009249.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:2617-1 vom 2021-08-05", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-August/009251.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:2616-1 vom 2021-08-05", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-August/009258.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:2634-1 vom 2021-08-06", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-August/009263.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:3590 vom 2021-09-21", "url": "https://access.redhat.com/errata/RHSA-2021:3590" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2021-3590 vom 2021-09-23", "url": "http://linux.oracle.com/errata/ELSA-2021-3590.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5022-3 vom 2021-10-07", "url": "https://ubuntu.com/security/notices/USN-5022-3" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:3811 vom 2021-10-12", "url": "https://access.redhat.com/errata/RHSA-2021:3811" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:1556 vom 2022-04-27", "url": "https://access.redhat.com/errata/RHSA-2022:1556" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:1557 vom 2022-04-27", "url": "https://access.redhat.com/errata/RHSA-2022:1557" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-1556 vom 2022-04-27", "url": "https://linux.oracle.com/errata/ELSA-2022-1556.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-1557 vom 2022-05-03", "url": "http://linux.oracle.com/errata/ELSA-2022-1557.html" }, { "category": "external", "summary": "Juniper Security Advisory JSA70182 vom 2023-01-12", "url": "https://supportportal.juniper.net/s/article/2023-01-Security-Bulletin-Contrail-Service-Orchestration-Multiple-vulnerabilities-resolved-in-CSO-6-3-0?language=en_US" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2023-1686 vom 2023-02-23", "url": "https://alas.aws.amazon.com/ALAS-2023-1686.html" } ], "source_lang": "en-US", "title": "Oracle MySQL: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-09-27T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:41:09.491+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-0065", "initial_release_date": "2021-04-20T22:00:00.000+00:00", "revision_history": [ { "date": "2021-04-20T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2021-05-05T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates aufgenommen" }, { "date": "2021-05-06T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates aufgenommen" }, { "date": "2021-05-13T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2021-05-19T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Arch Linux aufgenommen" }, { "date": "2021-05-25T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2021-08-04T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-08-05T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-08-08T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-09-20T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-09-22T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2021-10-07T22:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2021-10-12T22:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-04-26T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-04-27T22:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2022-05-03T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-01-11T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Juniper aufgenommen" }, { "date": "2023-02-22T23:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-09-27T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Amazon aufgenommen" } ], "status": "final", "version": "19" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "Juniper Contrail Service Orchestration", "product": { "name": "Juniper Contrail Service Orchestration", "product_id": "T025794", "product_identification_helper": { "cpe": "cpe:/a:juniper:contrail_service_orchestration:-" } } } ], "category": "vendor", "name": "Juniper" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "MariaDB MariaDB \u003c 10.3.29", "product": { "name": "MariaDB MariaDB \u003c 10.3.29", "product_id": "T019246", "product_identification_helper": { "cpe": "cpe:/a:mariadb:mariadb:10.3.29" } } }, { "category": "product_name", "name": "MariaDB MariaDB \u003c 10.2.38", "product": { "name": "MariaDB MariaDB \u003c 10.2.38", "product_id": "T019247", "product_identification_helper": { "cpe": "cpe:/a:mariadb:mariadb:10.2.38" } } } ], "category": "product_name", "name": "MariaDB" } ], "category": "vendor", "name": "MariaDB" }, { "branches": [ { "category": "product_name", "name": "Open Source Arch Linux", "product": { "name": "Open Source Arch Linux", "product_id": "T013312", "product_identification_helper": { "cpe": "cpe:/o:archlinux:archlinux:-" } } } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } }, { "branches": [ { "category": "product_name", "name": "Oracle MySQL \u003c= 8.0.23", "product": { "name": "Oracle MySQL \u003c= 8.0.23", "product_id": "858555", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:8.0.23" } } }, { "category": "product_name", "name": "Oracle MySQL \u003c= 5.7.33", "product": { "name": "Oracle MySQL \u003c= 5.7.33", "product_id": "858573", "product_identification_helper": { "cpe": "cpe:/a:oracle:mysql:5.7.33" } } } ], "category": "product_name", "name": "MySQL" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-7317", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2019-7317" }, { "cve": "CVE-2020-17527", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2020-17527" }, { "cve": "CVE-2020-17530", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2020-17530" }, { "cve": "CVE-2020-1971", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2020-1971" }, { "cve": "CVE-2020-28196", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2020-28196" }, { "cve": "CVE-2020-8277", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2020-8277" }, { "cve": "CVE-2021-2144", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2144" }, { "cve": "CVE-2021-2146", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2146" }, { "cve": "CVE-2021-2154", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2154" }, { "cve": "CVE-2021-2160", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2160" }, { "cve": "CVE-2021-2162", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2162" }, { "cve": "CVE-2021-2164", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2164" }, { "cve": "CVE-2021-2166", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2166" }, { "cve": "CVE-2021-2169", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2169" }, { "cve": "CVE-2021-2170", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2170" }, { "cve": "CVE-2021-2171", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2171" }, { "cve": "CVE-2021-2172", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2172" }, { "cve": "CVE-2021-2174", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2174" }, { "cve": "CVE-2021-2178", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2178" }, { "cve": "CVE-2021-2179", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2179" }, { "cve": "CVE-2021-2180", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2180" }, { "cve": "CVE-2021-2193", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2193" }, { "cve": "CVE-2021-2194", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2194" }, { "cve": "CVE-2021-2196", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2196" }, { "cve": "CVE-2021-2201", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2201" }, { "cve": "CVE-2021-2202", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2202" }, { "cve": "CVE-2021-2203", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2203" }, { "cve": "CVE-2021-2208", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2208" }, { "cve": "CVE-2021-2212", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2212" }, { "cve": "CVE-2021-2213", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2213" }, { "cve": "CVE-2021-2215", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2215" }, { "cve": "CVE-2021-2217", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2217" }, { "cve": "CVE-2021-2226", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2226" }, { "cve": "CVE-2021-2230", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2230" }, { "cve": "CVE-2021-2232", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2232" }, { "cve": "CVE-2021-2278", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2278" }, { "cve": "CVE-2021-2293", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2293" }, { "cve": "CVE-2021-2298", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2298" }, { "cve": "CVE-2021-2299", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2299" }, { "cve": "CVE-2021-2300", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2300" }, { "cve": "CVE-2021-2301", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2301" }, { "cve": "CVE-2021-2304", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2304" }, { "cve": "CVE-2021-2305", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2305" }, { "cve": "CVE-2021-2307", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2307" }, { "cve": "CVE-2021-2308", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-2308" }, { "cve": "CVE-2021-23841", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-23841" }, { "cve": "CVE-2021-3449", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-3449" }, { "cve": "CVE-2021-3450", "notes": [ { "category": "description", "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter Angreifer die Verf\u00fcgbarkeit, Vertraulichkeit und Integrit\u00e4t gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion und keine Authentisierung notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Availability\", \"Confidentiality\" und \"Integrity\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T002207", "67646", "T000126", "T013312", "398363", "T012167", "T004914", "T025794" ], "last_affected": [ "858573", "858555" ] }, "release_date": "2021-04-20T22:00:00.000+00:00", "title": "CVE-2021-3450" } ] }
var-201902-0855
Vulnerability from variot
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. libpng Exists in a vulnerability related to the use of freed memory.Service operation interruption (DoS) It may be in a state. 7) - aarch64, ppc64le
- Description:
Mozilla Thunderbird is a standalone mail and newsgroup client.
Software Description: - libpng1.6: PNG (Portable Network Graphics) file library
Details:
It was discovered that libpng incorrectly handled certain memory operations. ========================================================================== Ubuntu Security Notice USN-3991-2 June 06, 2019
firefox regression
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
USN-3991-1 caused a regression in Firefox. The update caused a regression which resulted in issues when upgrading between Ubuntu releases. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)
It was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)
It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)
A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied. Description:
IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
Security Fix(es):
-
IBM JDK: Failure to privatize a value pulled out of the loop by versioning (CVE-2019-11775)
-
OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)
-
OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)
-
OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)
-
libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bugs fixed (https://bugzilla.redhat.com/):
1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c 1730056 - CVE-2019-2769 OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) 1730099 - CVE-2019-2816 OpenJDK: Missing URL format validation (Networking, 8221518) 1730415 - CVE-2019-2762 OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) 1738549 - CVE-2019-11775 IBM JDK: Failure to privatize a value pulled out of the loop by versioning
For the stable distribution (stretch), these problems have been fixed in version 1:60.7.0-1~deb9u1.
For the detailed security status of thunderbird please refer to its security tracker page at: https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlzoWm4ACgkQEMKTtsN8 TjbzCxAAkzMt+0SOM3NCOQ6tLLP1EWDUnRiBvTwq6JfJYRvngfSc2A2oHKLtDPF7 8NNdpvzNyXZUo1ARTMmoK/5slDalTvUF6+11mydrHw2oIasIOuiaxN1N9mRk2nIN 7LF/cZZyu/ghjuoCV10F5BRropCRxGcZUBM1fTmz9RO7YFOvHmn6s+PmJCag6XWy Iuq3JIP6hNYPTi+UBCU7oaMQD0P9Z1x3QCs/kraYps3dUxH7/o8Kw5Yqa91TsTn9 KiQPoeTTHfwk3n4NKCgczpPW2OZQZncowa9dg9LFd6N0uGOgoy3bCIjR/xYk7fan VaxbkNX613KHDjZauUCit0MrvlXBxOi4S0jAY5tU5uCvM7EtNat6IozZyxfVcW+/ gGt6a+IUXAGD9Y5IjIklsDMm2aM2Wxx8B+Es4TUw1ihddKrtiQx6e1cYOPUSlsYH 7wgKKrIjwnQJ0B41pTqTKngDaFR9WGnQ2+Mix8OIrDKx7rilNtLnuhRvQ52ZAIoV 5qtzrm4WfuG0OJi5Sql4O7euTbQgnuPWqp448WiRMYtR9mSVMDUOxpG79Fx0R/Hi TBmSmzMxMPKcFdc0nqELSCi3YArxtsUUjSOrilji60VSwiLItxNZsPPzs94zYirV +BXY7WOtP26CgkaGhBoUDfU1JL8mwP5+UkHpmgoJbtADT2lBH/o= =uTpA -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Critical: firefox security update Advisory ID: RHSA-2019:1267-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:1267 Issue date: 2019-05-23 CVE Names: CVE-2018-18511 CVE-2019-5798 CVE-2019-7317 CVE-2019-9797 CVE-2019-9800 CVE-2019-9816 CVE-2019-9817 CVE-2019-9819 CVE-2019-9820 CVE-2019-11691 CVE-2019-11692 CVE-2019-11693 CVE-2019-11698 ==================================================================== 1. Summary:
An update for firefox is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - x86_64
- Description:
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
-
Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
-
Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
-
Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
-
Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
-
Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
-
Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
-
Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
-
Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
-
Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
-
mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
-
chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
-
Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
-
libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, Firefox must be restarted for the changes to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c 1676997 - CVE-2018-18511 mozilla: Cross-origin theft of images with ImageBitmapRenderingContext 1688200 - CVE-2019-5798 chromium-browser: Out of bounds read in Skia 1712617 - CVE-2019-11691 Mozilla: Use-after-free in XMLHttpRequest 1712618 - CVE-2019-11692 Mozilla: Use-after-free removing listeners in the event listener manager 1712619 - CVE-2019-11693 Mozilla: Buffer overflow in WebGL bufferdata on Linux 1712621 - CVE-2019-11698 Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks 1712622 - CVE-2019-9797 Mozilla: Cross-origin theft of images with createImageBitmap 1712623 - CVE-2019-9800 Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 1712625 - CVE-2019-9816 Mozilla: Type confusion with object groups and UnboxedObjects 1712626 - CVE-2019-9817 Mozilla: Stealing of cross-domain images using canvas 1712628 - CVE-2019-9819 Mozilla: Compartment mismatch with fetch API 1712629 - CVE-2019-9820 Mozilla: Use-after-free of ChromeEventHandler by DocShell
- Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source: firefox-60.7.0-1.el6_10.src.rpm
i386: firefox-60.7.0-1.el6_10.i686.rpm firefox-debuginfo-60.7.0-1.el6_10.i686.rpm
x86_64: firefox-60.7.0-1.el6_10.x86_64.rpm firefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
x86_64: firefox-60.7.0-1.el6_10.i686.rpm firefox-debuginfo-60.7.0-1.el6_10.i686.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source: firefox-60.7.0-1.el6_10.src.rpm
x86_64: firefox-60.7.0-1.el6_10.i686.rpm firefox-60.7.0-1.el6_10.x86_64.rpm firefox-debuginfo-60.7.0-1.el6_10.i686.rpm firefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: firefox-60.7.0-1.el6_10.src.rpm
i386: firefox-60.7.0-1.el6_10.i686.rpm firefox-debuginfo-60.7.0-1.el6_10.i686.rpm
ppc64: firefox-60.7.0-1.el6_10.ppc64.rpm firefox-debuginfo-60.7.0-1.el6_10.ppc64.rpm
s390x: firefox-60.7.0-1.el6_10.s390x.rpm firefox-debuginfo-60.7.0-1.el6_10.s390x.rpm
x86_64: firefox-60.7.0-1.el6_10.x86_64.rpm firefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
x86_64: firefox-60.7.0-1.el6_10.i686.rpm firefox-debuginfo-60.7.0-1.el6_10.i686.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: firefox-60.7.0-1.el6_10.src.rpm
i386: firefox-60.7.0-1.el6_10.i686.rpm firefox-debuginfo-60.7.0-1.el6_10.i686.rpm
x86_64: firefox-60.7.0-1.el6_10.x86_64.rpm firefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
x86_64: firefox-60.7.0-1.el6_10.i686.rpm firefox-debuginfo-60.7.0-1.el6_10.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2018-18511 https://access.redhat.com/security/cve/CVE-2019-5798 https://access.redhat.com/security/cve/CVE-2019-7317 https://access.redhat.com/security/cve/CVE-2019-9797 https://access.redhat.com/security/cve/CVE-2019-9800 https://access.redhat.com/security/cve/CVE-2019-9816 https://access.redhat.com/security/cve/CVE-2019-9817 https://access.redhat.com/security/cve/CVE-2019-9819 https://access.redhat.com/security/cve/CVE-2019-9820 https://access.redhat.com/security/cve/CVE-2019-11691 https://access.redhat.com/security/cve/CVE-2019-11692 https://access.redhat.com/security/cve/CVE-2019-11693 https://access.redhat.com/security/cve/CVE-2019-11698 https://access.redhat.com/security/updates/classification/#critical https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXObA+NzjgjWX9erEAQhdLg//Y2Qy3oBF2JXo0FDIAlvxGC0bBSZ5kIpr 2aZqeaEIQDfHbm2mNa5fGidU+zFgvwuAxmCjrURuGYx0GAtje4XH+oEa09Ri5VQS Wdm2faaOLj36IsIawC8RUQLzm8jIlZiYyeEKGFZj/PY8oFRcTBoebqqyTUAin+oC cCXcGcckGLouKi5rj9Q1pUcCzjnVDAUmMb00dF+8KbTUGHnMwMYF43ogBggN0ril ePFEsAZQ5tcapBQ7nqBkUJNsMMuKoVRcLyI+DUdEPOsetEhaOzMmWBkMtEV1VAN1 RaGzw6Xp34jVHhhqMznhFNZ/rkLVfr5hRwwTkeA9a8uq6kEW1LdhfIch62iWb00H AgSrwURUfOuPUKO6lHqg1FJEtIxqfY3GlpSCxhSWwZ/tUpmQcGuYK97zIl4lw5m4 i5dxQKxnVk+U116iU7kl3M8YKsK+HG2dFxjEFNdvnsnM+KBHurM5ANpo/AwP3E5i EKj4gL2USYekfUykbWk5gERbj/Rn8hdChgBFDGL7h7BevTw+jGXxctXDqw6n0BR+ yDJV98Vl44mkdrTnYvrIcFQTtNVMNkoS3ZbGq+tR/8ZZIwo28+qXnor1KTUBchJ/ HC8+r9xE+SZy2fxxI9esbwVkSsN5TaxOFFzf4uYDy/dQExCULJbQSsyGyvxdz0b8 74xrhCg7IBo=PKHG -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201902-0855", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "package hub", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": null }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "19.04" }, { "model": "enterprise linux", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "6.0" }, { "model": "enterprise linux for scientific computing", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "6.0" }, { "model": "satellite", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "5.8" }, { "model": "enterprise linux for power big endian", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "6.0" }, { "model": "enterprise linux", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "enterprise linux for scientific computing", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "hyperion infrastructure technology", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "11.2.6.0" }, { "model": "xp7 command view advanced edition suite", "scope": "lt", "trust": 1.0, "vendor": "hpe", "version": "8.7.0-00" }, { "model": "snapmanager", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": "3.4.2" }, { "model": "java se", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "8u212" }, { "model": "active iq unified manager", "scope": "lt", "trust": 1.0, "vendor": "netapp", "version": "9.6" }, { "model": "e-series santricity storage manager", "scope": "lt", "trust": 1.0, "vendor": "netapp", "version": "11.53" }, { "model": "libpng", "scope": "lt", "trust": 1.0, "vendor": "libpng", "version": "1.6.37" }, { "model": "e-series santricity management", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "enterprise linux for power big endian", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "enterprise linux desktop", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "6.0" }, { "model": "steelstore", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "enterprise linux desktop", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "libpng", "scope": "gte", "trust": 1.0, "vendor": "libpng", "version": "1.6.0" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "8.0" }, { "model": "oncommand insight", "scope": "lt", "trust": 1.0, "vendor": "netapp", "version": "7.3.9" }, { "model": "cloud backup", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "mysql", "scope": "lt", "trust": 1.0, "vendor": "oracle", "version": "8.0.23" }, { "model": "jdk", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "12.0.1" }, { "model": "enterprise linux for ibm z systems", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "8.0" }, { "model": "enterprise linux workstation", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "6.0" }, { "model": "leap", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "42.3" }, { "model": "enterprise linux for power little endian", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "8.0" }, { "model": "active iq unified manager", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": "9.6" }, { "model": "enterprise linux workstation", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "thunderbird", "scope": "eq", "trust": 1.0, "vendor": "mozilla", "version": null }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "18.04" }, { "model": "leap", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "15.0" }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "16.04" }, { "model": "oncommand workflow automation", "scope": "lt", "trust": 1.0, "vendor": "netapp", "version": "5.1" }, { "model": "jdk", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "11.0.3" }, { "model": "firefox", "scope": "eq", "trust": 1.0, "vendor": "mozilla", "version": null }, { "model": "e-series santricity web services", "scope": "lt", "trust": 1.0, "vendor": "netapp", "version": "4.0" }, { "model": "enterprise linux for ibm z systems", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "6.0" }, { "model": "snapmanager", "scope": "lt", "trust": 1.0, "vendor": "netapp", "version": "3.4.2" }, { "model": "enterprise linux", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "8.0" }, { "model": "e-series santricity unified manager", "scope": "lt", "trust": 1.0, "vendor": "netapp", "version": "3.2" }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "18.10" }, { "model": "java se", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "7u221" }, { "model": "enterprise linux for ibm z systems", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "plug-in for symantec netbackup", "scope": "eq", "trust": 1.0, "vendor": "netapp", "version": null }, { "model": "leap", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "15.1" }, { "model": "xp7 command view", "scope": "lt", "trust": 1.0, "vendor": "hp", "version": "8.7.0-00" }, { "model": "enterprise linux for power little endian", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "9.0" }, { "model": "ucosminexus client", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "ucosminexus service platform", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi application server", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "\u65e5\u7acb\u30a2\u30c9\u30d0\u30f3\u30b9\u30c8\u30b5\u30fc\u30d0 ha8000v \u30b7\u30ea\u30fc\u30ba", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi infrastructure analytics advisor", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "ucosminexus application server", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi developer\u0027s kit for java", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "ucosminexus service architect", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi configuration manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi replication manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "ucosminexus developer", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi global link manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi tiered storage manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi dynamic link manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi compute systems manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "cosminexus developer\u0027s kit for java", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi tuning manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "libpng", "scope": null, "trust": 0.8, "vendor": "png group", "version": null }, { "model": "hitachi device manager", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null }, { "model": "hitachi automation director", "scope": null, "trust": 0.8, "vendor": "\u65e5\u7acb", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "db": "NVD", "id": "CVE-2019-7317" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Red Hat", "sources": [ { "db": "PACKETSTORM", "id": "153157" }, { "db": "PACKETSTORM", "id": "154457" }, { "db": "PACKETSTORM", "id": "154068" }, { "db": "PACKETSTORM", "id": "154282" }, { "db": "PACKETSTORM", "id": "153065" } ], "trust": 0.5 }, "cve": "CVE-2019-7317", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 2.6, "confidentialityImpact": "NONE", "exploitabilityScore": 4.9, "id": "CVE-2019-7317", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 1.9, "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "HIGH", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "exploitabilityScore": 1.6, "id": "CVE-2019-7317", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "High", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 5.3, "baseSeverity": "Medium", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2019-7317", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2019-7317", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2019-7317", "trust": 0.8, "value": "Medium" }, { "author": "VULMON", "id": "CVE-2019-7317", "trust": 0.1, "value": "LOW" } ] } ], "sources": [ { "db": "VULMON", "id": "CVE-2019-7317" }, { "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "db": "NVD", "id": "CVE-2019-7317" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. libpng Exists in a vulnerability related to the use of freed memory.Service operation interruption (DoS) It may be in a state. 7) - aarch64, ppc64le\n\n3. Description:\n\nMozilla Thunderbird is a standalone mail and newsgroup client. \n\nSoftware Description:\n- libpng1.6: PNG (Portable Network Graphics) file library\n\nDetails:\n\nIt was discovered that libpng incorrectly handled certain memory\noperations. ==========================================================================\nUbuntu Security Notice USN-3991-2\nJune 06, 2019\n\nfirefox regression\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 19.04\n- Ubuntu 18.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nUSN-3991-1 caused a regression in Firefox. The update caused a\nregression which resulted in issues when upgrading between Ubuntu\nreleases. This update fixes the problem. \n\nWe apologize for the inconvenience. \n\nOriginal advisory details:\n\n Multiple security issues were discovered in Firefox. If a user were\n tricked in to opening a specially crafted website, an attacker could\n potentially exploit these to cause a denial of service, spoof the browser\n UI, trick the user in to launching local executable binaries, obtain\n sensitive information, conduct cross-site scripting (XSS) attacks, or\n execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,\n CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701,\n CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819,\n CVE-2019-9820, CVE-2019-9821)\n \n It was discovered that pressing certain key combinations could bypass\n addon installation prompt delays. If a user opened a specially crafted\n website, an attacker could potentially exploit this to trick them in to\n installing a malicious extension. (CVE-2019-11697)\n \n It was discovered that history data could be exposed via drag and drop\n of hyperlinks to and from bookmarks. If a user were tricked in to dragging\n a specially crafted hyperlink to the bookmark toolbar or sidebar, and\n subsequently back in to the web content area, an attacker could\n potentially exploit this to obtain sensitive information. (CVE-2019-11698)\n \n A type confusion bug was discovered with object groups and UnboxedObjects. \n If a user were tricked in to opening a specially crafted website after\n enabling the UnboxedObjects feature, an attacker could potentially\n exploit this to bypass security checks. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. Description:\n\nIBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment\nand the IBM Java Software Development Kit. \n\nSecurity Fix(es):\n\n* IBM JDK: Failure to privatize a value pulled out of the loop by\nversioning (CVE-2019-11775)\n\n* OpenJDK: Insufficient checks of suppressed exceptions in deserialization\n(Utilities, 8212328) (CVE-2019-2762)\n\n* OpenJDK: Unbounded memory allocation during deserialization in\nCollections (Utilities, 8213432) (CVE-2019-2769)\n\n* OpenJDK: Missing URL format validation (Networking, 8221518)\n(CVE-2019-2816)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. Bugs fixed (https://bugzilla.redhat.com/):\n\n1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c\n1730056 - CVE-2019-2769 OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)\n1730099 - CVE-2019-2816 OpenJDK: Missing URL format validation (Networking, 8221518)\n1730415 - CVE-2019-2762 OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)\n1738549 - CVE-2019-11775 IBM JDK: Failure to privatize a value pulled out of the loop by versioning\n\n6. \n\t\t\t\t \nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:60.7.0-1~deb9u1. \n\nFor the detailed security status of thunderbird please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/thunderbird\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlzoWm4ACgkQEMKTtsN8\nTjbzCxAAkzMt+0SOM3NCOQ6tLLP1EWDUnRiBvTwq6JfJYRvngfSc2A2oHKLtDPF7\n8NNdpvzNyXZUo1ARTMmoK/5slDalTvUF6+11mydrHw2oIasIOuiaxN1N9mRk2nIN\n7LF/cZZyu/ghjuoCV10F5BRropCRxGcZUBM1fTmz9RO7YFOvHmn6s+PmJCag6XWy\nIuq3JIP6hNYPTi+UBCU7oaMQD0P9Z1x3QCs/kraYps3dUxH7/o8Kw5Yqa91TsTn9\nKiQPoeTTHfwk3n4NKCgczpPW2OZQZncowa9dg9LFd6N0uGOgoy3bCIjR/xYk7fan\nVaxbkNX613KHDjZauUCit0MrvlXBxOi4S0jAY5tU5uCvM7EtNat6IozZyxfVcW+/\ngGt6a+IUXAGD9Y5IjIklsDMm2aM2Wxx8B+Es4TUw1ihddKrtiQx6e1cYOPUSlsYH\n7wgKKrIjwnQJ0B41pTqTKngDaFR9WGnQ2+Mix8OIrDKx7rilNtLnuhRvQ52ZAIoV\n5qtzrm4WfuG0OJi5Sql4O7euTbQgnuPWqp448WiRMYtR9mSVMDUOxpG79Fx0R/Hi\nTBmSmzMxMPKcFdc0nqELSCi3YArxtsUUjSOrilji60VSwiLItxNZsPPzs94zYirV\n+BXY7WOtP26CgkaGhBoUDfU1JL8mwP5+UkHpmgoJbtADT2lBH/o=\n=uTpA\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Critical: firefox security update\nAdvisory ID: RHSA-2019:1267-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2019:1267\nIssue date: 2019-05-23\nCVE Names: CVE-2018-18511 CVE-2019-5798 CVE-2019-7317\n CVE-2019-9797 CVE-2019-9800 CVE-2019-9816\n CVE-2019-9817 CVE-2019-9819 CVE-2019-9820\n CVE-2019-11691 CVE-2019-11692 CVE-2019-11693\n CVE-2019-11698\n====================================================================\n1. Summary:\n\nAn update for firefox is now available for Red Hat Enterprise Linux 6. \n\nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Desktop (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Desktop Optional (v. 6) - x86_64\nRed Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - x86_64\n\n3. Description:\n\nMozilla Firefox is an open-source web browser, designed for standards\ncompliance, performance, and portability. \n\nThis update upgrades Firefox to version 60.7.0 ESR. \n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7\n(CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap\n(CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects\n(CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager\n(CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext\n(CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks\nto and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to\ntake effect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1672409 - CVE-2019-7317 libpng: use-after-free in png_image_free in png.c\n1676997 - CVE-2018-18511 mozilla: Cross-origin theft of images with ImageBitmapRenderingContext\n1688200 - CVE-2019-5798 chromium-browser: Out of bounds read in Skia\n1712617 - CVE-2019-11691 Mozilla: Use-after-free in XMLHttpRequest\n1712618 - CVE-2019-11692 Mozilla: Use-after-free removing listeners in the event listener manager\n1712619 - CVE-2019-11693 Mozilla: Buffer overflow in WebGL bufferdata on Linux\n1712621 - CVE-2019-11698 Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks\n1712622 - CVE-2019-9797 Mozilla: Cross-origin theft of images with createImageBitmap\n1712623 - CVE-2019-9800 Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7\n1712625 - CVE-2019-9816 Mozilla: Type confusion with object groups and UnboxedObjects\n1712626 - CVE-2019-9817 Mozilla: Stealing of cross-domain images using canvas\n1712628 - CVE-2019-9819 Mozilla: Compartment mismatch with fetch API\n1712629 - CVE-2019-9820 Mozilla: Use-after-free of ChromeEventHandler by DocShell\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 6):\n\nSource:\nfirefox-60.7.0-1.el6_10.src.rpm\n\ni386:\nfirefox-60.7.0-1.el6_10.i686.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.i686.rpm\n\nx86_64:\nfirefox-60.7.0-1.el6_10.x86_64.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Optional (v. 6):\n\nx86_64:\nfirefox-60.7.0-1.el6_10.i686.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.i686.rpm\n\nRed Hat Enterprise Linux HPC Node Optional (v. 6):\n\nSource:\nfirefox-60.7.0-1.el6_10.src.rpm\n\nx86_64:\nfirefox-60.7.0-1.el6_10.i686.rpm\nfirefox-60.7.0-1.el6_10.x86_64.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.i686.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nfirefox-60.7.0-1.el6_10.src.rpm\n\ni386:\nfirefox-60.7.0-1.el6_10.i686.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.i686.rpm\n\nppc64:\nfirefox-60.7.0-1.el6_10.ppc64.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.ppc64.rpm\n\ns390x:\nfirefox-60.7.0-1.el6_10.s390x.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.s390x.rpm\n\nx86_64:\nfirefox-60.7.0-1.el6_10.x86_64.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\nx86_64:\nfirefox-60.7.0-1.el6_10.i686.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.i686.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nfirefox-60.7.0-1.el6_10.src.rpm\n\ni386:\nfirefox-60.7.0-1.el6_10.i686.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.i686.rpm\n\nx86_64:\nfirefox-60.7.0-1.el6_10.x86_64.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\nx86_64:\nfirefox-60.7.0-1.el6_10.i686.rpm\nfirefox-debuginfo-60.7.0-1.el6_10.i686.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-18511\nhttps://access.redhat.com/security/cve/CVE-2019-5798\nhttps://access.redhat.com/security/cve/CVE-2019-7317\nhttps://access.redhat.com/security/cve/CVE-2019-9797\nhttps://access.redhat.com/security/cve/CVE-2019-9800\nhttps://access.redhat.com/security/cve/CVE-2019-9816\nhttps://access.redhat.com/security/cve/CVE-2019-9817\nhttps://access.redhat.com/security/cve/CVE-2019-9819\nhttps://access.redhat.com/security/cve/CVE-2019-9820\nhttps://access.redhat.com/security/cve/CVE-2019-11691\nhttps://access.redhat.com/security/cve/CVE-2019-11692\nhttps://access.redhat.com/security/cve/CVE-2019-11693\nhttps://access.redhat.com/security/cve/CVE-2019-11698\nhttps://access.redhat.com/security/updates/classification/#critical\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-14/\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXObA+NzjgjWX9erEAQhdLg//Y2Qy3oBF2JXo0FDIAlvxGC0bBSZ5kIpr\n2aZqeaEIQDfHbm2mNa5fGidU+zFgvwuAxmCjrURuGYx0GAtje4XH+oEa09Ri5VQS\nWdm2faaOLj36IsIawC8RUQLzm8jIlZiYyeEKGFZj/PY8oFRcTBoebqqyTUAin+oC\ncCXcGcckGLouKi5rj9Q1pUcCzjnVDAUmMb00dF+8KbTUGHnMwMYF43ogBggN0ril\nePFEsAZQ5tcapBQ7nqBkUJNsMMuKoVRcLyI+DUdEPOsetEhaOzMmWBkMtEV1VAN1\nRaGzw6Xp34jVHhhqMznhFNZ/rkLVfr5hRwwTkeA9a8uq6kEW1LdhfIch62iWb00H\nAgSrwURUfOuPUKO6lHqg1FJEtIxqfY3GlpSCxhSWwZ/tUpmQcGuYK97zIl4lw5m4\ni5dxQKxnVk+U116iU7kl3M8YKsK+HG2dFxjEFNdvnsnM+KBHurM5ANpo/AwP3E5i\nEKj4gL2USYekfUykbWk5gERbj/Rn8hdChgBFDGL7h7BevTw+jGXxctXDqw6n0BR+\nyDJV98Vl44mkdrTnYvrIcFQTtNVMNkoS3ZbGq+tR/8ZZIwo28+qXnor1KTUBchJ/\nHC8+r9xE+SZy2fxxI9esbwVkSsN5TaxOFFzf4uYDy/dQExCULJbQSsyGyvxdz0b8\n74xrhCg7IBo=PKHG\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n", "sources": [ { "db": "NVD", "id": "CVE-2019-7317" }, { "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "db": "VULMON", "id": "CVE-2019-7317" }, { "db": "PACKETSTORM", "id": "153157" }, { "db": "PACKETSTORM", "id": "152702" }, { "db": "PACKETSTORM", "id": "153212" }, { "db": "PACKETSTORM", "id": "154457" }, { "db": "PACKETSTORM", "id": "154068" }, { "db": "PACKETSTORM", "id": "153087" }, { "db": "PACKETSTORM", "id": "154282" }, { "db": "PACKETSTORM", "id": "153065" } ], "trust": 2.43 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2019-7317", "trust": 3.5 }, { "db": "PACKETSTORM", "id": "152561", "trust": 1.1 }, { "db": "BID", "id": "108098", "trust": 1.1 }, { "db": "JVNDB", "id": "JVNDB-2019-001545", "trust": 0.8 }, { "db": "VULMON", "id": "CVE-2019-7317", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "153157", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "152702", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "153212", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "154457", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "154068", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "153087", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "154282", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "153065", "trust": 0.1 } ], "sources": [ { "db": "VULMON", "id": "CVE-2019-7317" }, { "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "db": "PACKETSTORM", "id": "153157" }, { "db": "PACKETSTORM", "id": "152702" }, { "db": "PACKETSTORM", "id": "153212" }, { "db": "PACKETSTORM", "id": "154457" }, { "db": "PACKETSTORM", "id": "154068" }, { "db": "PACKETSTORM", "id": "153087" }, { "db": "PACKETSTORM", "id": "154282" }, { "db": "PACKETSTORM", "id": "153065" }, { "db": "NVD", "id": "CVE-2019-7317" } ] }, "id": "VAR-201902-0855", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.23809524 }, "last_update_date": "2024-11-29T21:03:54.864000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "hitachi-sec-2019-116 Software product security information", "trust": 0.8, "url": "https://github.com/glennrp/libpng/issues/275" }, { "title": "Debian CVElist Bug Report Logs: libpng1.6: CVE-2019-7317: use-after-free in png_image_free in png.c", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=ef2bbc82329f4e3dd9e23c0137af2a7b" }, { "title": "Ubuntu Security Notice: libpng1.6 vulnerability", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3962-1" }, { "title": "Debian Security Advisories: DSA-4435-1 libpng1.6 -- security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=d60ba88361ab9afdcad18ca2a106ac3b" }, { "title": "Red Hat: Important: java-1.7.1-ibm security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20192494 - Security Advisory" }, { "title": "Red Hat: Important: java-1.7.1-ibm security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20192495 - Security Advisory" }, { "title": "Arch Linux Advisories: [ASA-201904-10] libpng: denial of service", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201904-10" }, { "title": "Red Hat: Important: java-1.8.0-ibm security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20192737 - Security Advisory" }, { "title": "Red Hat: CVE-2019-7317", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2019-7317" }, { "title": "Red Hat: Important: java-1.8.0-ibm security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20192585 - Security Advisory" }, { "title": "Red Hat: Important: java-1.8.0-ibm security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20192590 - Security Advisory" }, { "title": "Red Hat: Important: java-1.8.0-ibm security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20192592 - Security Advisory" }, { "title": "Arch Linux Issues: ", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2019-7317" }, { "title": "Red Hat: Important: thunderbird security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20191308 - Security Advisory" }, { "title": "Red Hat: Important: thunderbird security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20191310 - Security Advisory" }, { "title": "Red Hat: Critical: firefox security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20191265 - Security Advisory" }, { "title": "Red Hat: Critical: firefox security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20191269 - Security Advisory" }, { "title": "Red Hat: Important: thunderbird security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20191309 - Security Advisory" }, { "title": "Ubuntu Security Notice: openjdk-lts vulnerabilities", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-4083-1" }, { "title": "Red Hat: Critical: firefox security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20191267 - Security Advisory" }, { "title": "Ubuntu Security Notice: openjdk-8 vulnerabilities", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-4080-1" }, { "title": "Ubuntu Security Notice: thunderbird vulnerabilities", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3997-1" }, { "title": "Debian Security Advisories: DSA-4451-1 thunderbird -- security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=1cf7f39c2c474666174a69cf97b06740" }, { "title": "Ubuntu Security Notice: firefox regression", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3991-3" }, { "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=61e62f4d9c861153c6391afc0ec560a4" }, { "title": "Debian Security Advisories: DSA-4448-1 firefox-esr -- security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=e2d9ccf571c31c1011ad31af2798140f" }, { "title": "Ubuntu Security Notice: firefox regression", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3991-2" }, { "title": "Ubuntu Security Notice: firefox vulnerabilities", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3991-1" }, { "title": "Arch Linux Advisories: [ASA-201905-8] thunderbird: multiple issues", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201905-8" }, { "title": "Amazon Linux 2: ALAS2-2019-1246", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2019-1246" }, { "title": "Mozilla: Mozilla Foundation Security Advisory 2019-14", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=2019-14" }, { "title": "IBM: IBM Security Bulletin: Multiple Mozilla Firefox vulnerability in IBM SONAS", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=4a8e20a238934bc47ca332a3c76cc9c3" }, { "title": "Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager and Hitachi Infrastructure Analytics Advisor", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories\u0026qid=hitachi-sec-2019-117" }, { "title": "IBM: Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage Systems (January 2020v2)", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=acad3ac1b2767940a01b72ed1b51586b" }, { "title": "Arch Linux Advisories: [ASA-201905-9] firefox: multiple issues", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201905-9" }, { "title": "Hitachi Security Advisories: Multiple Vulnerabilities in Cosminexus", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories\u0026qid=hitachi-sec-2019-116" }, { "title": "Amazon Linux 2: ALAS2-2019-1229", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2019-1229" }, { "title": "Mozilla: Security vulnerabilities fixed in Firefox ESR 60.7", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=554d832b08166d6d04a53f3c421e7f9b" }, { "title": "IBM: IBM Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU \u2013 Jul 2019 \u2013 Includes Oracle Jul 2019 CPU affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=de7b9859dff396513e72da22ffc4ab3e" }, { "title": "Mozilla: Mozilla Foundation Security Advisory 2019-15", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=2019-15" }, { "title": "Mozilla: Security vulnerabilities fixed in Thunderbird 60.7", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=198e3a670ab8c803584e801da3919e61" }, { "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities may affect IBM\u00ae SDK, Java\u2122 Technology Edition", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=836b059f33e614408bd51705b325caaf" }, { "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=b352b6737bfbf2a62b0a2201928e8963" }, { "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Manager with OpenStack", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=1ad5c6091de269fb79e0c4d1c06b0846" }, { "title": "Mozilla: Security vulnerabilities fixed in Firefox 67", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=730fce689efe63b7de803de0d8794796" }, { "title": "Mozilla: Mozilla Foundation Security Advisory 2019-13", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=2019-13" }, { "title": "IBM: IBM Security Bulletin: Vyatta 5600 vRouter Software Patches \u2013 Release 1801-z", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=4ef3e54cc5cdc194f0526779f9480f89" } ], "sources": [ { "db": "VULMON", "id": "CVE-2019-7317" }, { "db": "JVNDB", "id": "JVNDB-2019-001545" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-416", "trust": 1.0 }, { "problemtype": "Use of freed memory (CWE-416) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "db": "NVD", "id": "CVE-2019-7317" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-7317" }, { "trust": 1.2, "url": "https://usn.ubuntu.com/3962-1/" }, { "trust": 1.2, "url": "https://access.redhat.com/errata/rhsa-2019:1267" }, { "trust": 1.2, "url": "https://access.redhat.com/errata/rhsa-2019:1309" }, { "trust": 1.2, "url": "http://www.securityfocus.com/bid/108098" }, { "trust": 1.2, "url": "https://access.redhat.com/errata/rhsa-2019:2495" }, { "trust": 1.2, "url": "https://access.redhat.com/errata/rhsa-2019:2585" }, { "trust": 1.2, "url": "https://access.redhat.com/errata/rhsa-2019:2737" }, { "trust": 1.1, "url": "https://github.com/glennrp/libpng/issues/275" }, { "trust": 1.1, "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803" }, { "trust": 1.1, "url": "https://seclists.org/bugtraq/2019/apr/30" }, { "trust": 1.1, "url": "http://packetstormsecurity.com/files/152561/slackware-security-advisory-libpng-updates.html" }, { "trust": 1.1, "url": "https://www.debian.org/security/2019/dsa-4435" }, { "trust": 1.1, "url": "https://seclists.org/bugtraq/2019/apr/36" }, { "trust": 1.1, "url": "https://usn.ubuntu.com/3991-1/" }, { "trust": 1.1, "url": "https://seclists.org/bugtraq/2019/may/56" }, { "trust": 1.1, "url": "https://seclists.org/bugtraq/2019/may/59" }, { "trust": 1.1, "url": "https://www.debian.org/security/2019/dsa-4448" }, { "trust": 1.1, "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html" }, { "trust": 1.1, "url": "https://access.redhat.com/errata/rhsa-2019:1265" }, { "trust": 1.1, "url": "https://access.redhat.com/errata/rhsa-2019:1269" }, { "trust": 1.1, "url": "https://www.debian.org/security/2019/dsa-4451" }, { "trust": 1.1, "url": "https://seclists.org/bugtraq/2019/may/67" }, { "trust": 1.1, "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "trust": 1.1, "url": "https://usn.ubuntu.com/3997-1/" }, { "trust": 1.1, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "trust": 1.1, "url": "https://access.redhat.com/errata/rhsa-2019:1310" }, { "trust": 1.1, "url": "https://access.redhat.com/errata/rhsa-2019:1308" }, { "trust": 1.1, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "trust": 1.1, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "trust": 1.1, "url": "https://security.netapp.com/advisory/ntap-20190719-0005/" }, { "trust": 1.1, "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "trust": 1.1, "url": "https://usn.ubuntu.com/4080-1/" }, { "trust": 1.1, "url": "https://usn.ubuntu.com/4083-1/" }, { "trust": 1.1, "url": "https://security.gentoo.org/glsa/201908-02" }, { "trust": 1.1, "url": "https://access.redhat.com/errata/rhsa-2019:2494" }, { "trust": 1.1, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html" }, { "trust": 1.1, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html" }, { "trust": 1.1, "url": "https://access.redhat.com/errata/rhsa-2019:2590" }, { "trust": 1.1, "url": "https://access.redhat.com/errata/rhsa-2019:2592" }, { "trust": 1.1, "url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbst03977en_us" }, { "trust": 1.1, "url": "https://www.oracle.com/security-alerts/cpuapr2021.html" }, { "trust": 1.1, "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "trust": 0.5, "url": "https://access.redhat.com/articles/11258" }, { "trust": 0.5, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.5, "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.5, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.5, "url": "https://access.redhat.com/security/team/key/" }, { "trust": 0.5, "url": "https://access.redhat.com/security/cve/cve-2019-7317" }, { "trust": 0.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9820" }, { "trust": 0.4, "url": "https://access.redhat.com/security/updates/classification/#important" }, { "trust": 0.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11698" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-18511" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11691" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9819" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9800" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9817" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9797" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-5798" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11693" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11692" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9816" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2019-11775" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2019-2762" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2019-2769" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2769" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11775" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2816" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2019-2816" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2762" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-9817" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-11698" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-9797" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-11692" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-11693" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-9819" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2018-18511" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-9820" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-9800" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-11691" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-5798" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11772" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2786" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-11772" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-2786" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/416.html" }, { "trust": 0.1, "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921355" }, { "trust": 0.1, "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=59551" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2019-15/" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/usn/usn-3962-1" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/libpng1.6/1.6.34-2ubuntu0.1" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/libpng1.6/1.6.34-1ubuntu0.18.04.2" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11697" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.16.04.1" }, { "trust": 0.1, "url": "https://launchpad.net/bugs/1830096" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/3991-2" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.19.04.1" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.18.10.1" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11695" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/3991-1" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.18.04.1" }, { "trust": 0.1, "url": "https://www.debian.org/security/faq" }, { "trust": 0.1, "url": "https://www.debian.org/security/" }, { "trust": 0.1, "url": "https://security-tracker.debian.org/tracker/thunderbird" }, { "trust": 0.1, "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-9816" }, { "trust": 0.1, "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2019-14/" } ], "sources": [ { "db": "VULMON", "id": "CVE-2019-7317" }, { "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "db": "PACKETSTORM", "id": "153157" }, { "db": "PACKETSTORM", "id": "152702" }, { "db": "PACKETSTORM", "id": "153212" }, { "db": "PACKETSTORM", "id": "154457" }, { "db": "PACKETSTORM", "id": "154068" }, { "db": "PACKETSTORM", "id": "153087" }, { "db": "PACKETSTORM", "id": "154282" }, { "db": "PACKETSTORM", "id": "153065" }, { "db": "NVD", "id": "CVE-2019-7317" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULMON", "id": "CVE-2019-7317" }, { "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "db": "PACKETSTORM", "id": "153157" }, { "db": "PACKETSTORM", "id": "152702" }, { "db": "PACKETSTORM", "id": "153212" }, { "db": "PACKETSTORM", "id": "154457" }, { "db": "PACKETSTORM", "id": "154068" }, { "db": "PACKETSTORM", "id": "153087" }, { "db": "PACKETSTORM", "id": "154282" }, { "db": "PACKETSTORM", "id": "153065" }, { "db": "NVD", "id": "CVE-2019-7317" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-02-04T00:00:00", "db": "VULMON", "id": "CVE-2019-7317" }, { "date": "2019-03-14T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "date": "2019-06-03T14:44:44", "db": "PACKETSTORM", "id": "153157" }, { "date": "2019-05-01T16:22:22", "db": "PACKETSTORM", "id": "152702" }, { "date": "2019-06-06T17:02:22", "db": "PACKETSTORM", "id": "153212" }, { "date": "2019-09-11T19:58:39", "db": "PACKETSTORM", "id": "154457" }, { "date": "2019-08-15T20:14:24", "db": "PACKETSTORM", "id": "154068" }, { "date": "2019-05-24T23:22:22", "db": "PACKETSTORM", "id": "153087" }, { "date": "2019-09-02T17:37:20", "db": "PACKETSTORM", "id": "154282" }, { "date": "2019-05-23T16:55:38", "db": "PACKETSTORM", "id": "153065" }, { "date": "2019-02-04T08:29:00.447000", "db": "NVD", "id": "CVE-2019-7317" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-05-23T00:00:00", "db": "VULMON", "id": "CVE-2019-7317" }, { "date": "2022-07-05T03:02:00", "db": "JVNDB", "id": "JVNDB-2019-001545" }, { "date": "2024-11-21T04:48:00.033000", "db": "NVD", "id": "CVE-2019-7317" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "PACKETSTORM", "id": "152702" } ], "trust": 0.1 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "libpng\u00a0 Vulnerability in using free memory in", "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-001545" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "overflow", "sources": [ { "db": "PACKETSTORM", "id": "153157" }, { "db": "PACKETSTORM", "id": "153065" } ], "trust": 0.2 } }
gsd-2019-7317
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2019-7317", "description": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "id": "GSD-2019-7317", "references": [ "https://www.suse.com/security/cve/CVE-2019-7317.html", "https://www.debian.org/security/2019/dsa-4451", "https://www.debian.org/security/2019/dsa-4448", "https://www.debian.org/security/2019/dsa-4435", "https://access.redhat.com/errata/RHSA-2019:2737", "https://access.redhat.com/errata/RHSA-2019:2592", "https://access.redhat.com/errata/RHSA-2019:2590", "https://access.redhat.com/errata/RHSA-2019:2585", "https://access.redhat.com/errata/RHSA-2019:2495", "https://access.redhat.com/errata/RHSA-2019:2494", "https://access.redhat.com/errata/RHSA-2019:1310", "https://access.redhat.com/errata/RHSA-2019:1309", "https://access.redhat.com/errata/RHSA-2019:1308", "https://access.redhat.com/errata/RHSA-2019:1269", "https://access.redhat.com/errata/RHSA-2019:1267", "https://access.redhat.com/errata/RHSA-2019:1265", "https://ubuntu.com/security/CVE-2019-7317", "https://advisories.mageia.org/CVE-2019-7317.html", "https://security.archlinux.org/CVE-2019-7317", "https://linux.oracle.com/cve/CVE-2019-7317.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2019-7317" ], "details": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "id": "GSD-2019-7317", "modified": "2023-12-13T01:23:46.319339Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-7317", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "20190417 [slackware-security] libpng (SSA:2019-107-01)", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Apr/30" }, { "name": "DSA-4435", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4435" }, { "name": "20190429 [SECURITY] [DSA 4435-1] libpng1.6 security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Apr/36" }, { "name": "USN-3962-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3962-1/" }, { "name": "USN-3991-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3991-1/" }, { "name": "20190522 [slackware-security] mozilla-firefox (SSA:2019-141-01)", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/56" }, { "name": "20190523 [SECURITY] [DSA 4448-1] firefox-esr security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/59" }, { "name": "DSA-4448", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4448" }, { "name": "[debian-lts-announce] 20190523 [SECURITY] [DLA 1800-1] firefox-esr security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html" }, { "name": "RHSA-2019:1265", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "name": "RHSA-2019:1267", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "name": "RHSA-2019:1269", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "name": "DSA-4451", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1308", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "RHSA-2019:1309", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "openSUSE-SU-2019:1534", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "108098", "refsource": "BID", "url": "http://www.securityfocus.com/bid/108098" }, { "name": "USN-4080-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4080-1/" }, { "name": "USN-4083-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4083-1/" }, { "name": "GLSA-201908-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201908-02" }, { "name": "RHSA-2019:2494", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2494" }, { "name": "RHSA-2019:2495", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2495" }, { "name": "openSUSE-SU-2019:1916", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html" }, { "name": "openSUSE-SU-2019:1912", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html" }, { "name": "RHSA-2019:2585", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2585" }, { "name": "RHSA-2019:2590", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2590" }, { "name": "RHSA-2019:2592", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2592" }, { "name": "RHSA-2019:2737", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2737" }, { "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "refsource": "MISC", "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803", "refsource": "MISC", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803" }, { "name": "https://github.com/glennrp/libpng/issues/275", "refsource": "MISC", "url": "https://github.com/glennrp/libpng/issues/275" }, { "name": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html" }, { "name": "https://security.netapp.com/advisory/ntap-20190719-0005/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190719-0005/" }, { "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us", "refsource": "CONFIRM", "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "[1.6.36]", "affected_versions": "Version 1.6.36", "cvss_v2": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "cvss_v3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "cwe_ids": [ "CWE-1035", "CWE-416", "CWE-937" ], "date": "2021-10-20", "description": "png_image_free in png.c in libpng has a use-after-free because png_image_free_function is called under png_safe_execute.", "fixed_versions": [], "identifier": "CVE-2019-7317", "identifiers": [ "CVE-2019-7317" ], "not_impacted": "", "package_slug": "nuget/libpng", "pubdate": "2019-02-04", "solution": "Unfortunately, there is no solution available yet.", "title": "Use After Free", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" ], "uuid": "f57a9f10-e03e-4592-ab59-50301b5df9e4" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.6.37", "versionStartIncluding": "1.6.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:jdk:11.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jdk:12.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:java_se:8u212:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:java_se:7u221:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "8.0.23", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:hpe:xp7_command_view_advanced_edition_suite:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "8.7.0-00", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*", "cpe_name": [], "versionEndExcluding": "8.7.0-00", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:opensuse:package_hub:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:vcenter:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*", "cpe_name": [], "versionEndExcluding": "3.4.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*", "cpe_name": [], "versionEndExcluding": "3.4.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:sap:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:oracle:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:vmware_vsphere:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*", "cpe_name": [], "versionEndExcluding": "9.6", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*", "cpe_name": [], "versionEndExcluding": "9.6", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:windows:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "11.53", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_unified_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:*", "cpe_name": [], "versionEndExcluding": "4.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "7.3.9", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "5.1", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-7317" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-416" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/glennrp/libpng/issues/275", "refsource": "MISC", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://github.com/glennrp/libpng/issues/275" }, { "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803", "refsource": "MISC", "tags": [ "Issue Tracking", "Mailing List", "Third Party Advisory" ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803" }, { "name": "20190417 [slackware-security] libpng (SSA:2019-107-01)", "refsource": "BUGTRAQ", "tags": [ "Issue Tracking", "Mailing List", "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/Apr/30" }, { "name": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html", "refsource": "MISC", "tags": [ "VDB Entry", "Third Party Advisory" ], "url": "http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html" }, { "name": "DSA-4435", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2019/dsa-4435" }, { "name": "20190429 [SECURITY] [DSA 4435-1] libpng1.6 security update", "refsource": "BUGTRAQ", "tags": [ "Issue Tracking", "Mailing List", "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/Apr/36" }, { "name": "USN-3962-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/3962-1/" }, { "name": "USN-3991-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/3991-1/" }, { "name": "20190522 [slackware-security] mozilla-firefox (SSA:2019-141-01)", "refsource": "BUGTRAQ", "tags": [ "Issue Tracking", "Mailing List", "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/May/56" }, { "name": "20190523 [SECURITY] [DSA 4448-1] firefox-esr security update", "refsource": "BUGTRAQ", "tags": [ "Issue Tracking", "Mailing List", "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/May/59" }, { "name": "DSA-4448", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2019/dsa-4448" }, { "name": "[debian-lts-announce] 20190523 [SECURITY] [DLA 1800-1] firefox-esr security update", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html" }, { "name": "RHSA-2019:1265", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "name": "RHSA-2019:1269", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "name": "RHSA-2019:1267", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "name": "DSA-4451", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "refsource": "BUGTRAQ", "tags": [ "Issue Tracking", "Mailing List", "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1309", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "RHSA-2019:1308", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "openSUSE-SU-2019:1534", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "108098", "refsource": "BID", "tags": [ "Not Applicable", "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/108098" }, { "name": "https://security.netapp.com/advisory/ntap-20190719-0005/", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://security.netapp.com/advisory/ntap-20190719-0005/" }, { "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "name": "USN-4080-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4080-1/" }, { "name": "USN-4083-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4083-1/" }, { "name": "GLSA-201908-02", "refsource": "GENTOO", "tags": [ "Third Party Advisory" ], "url": "https://security.gentoo.org/glsa/201908-02" }, { "name": "RHSA-2019:2494", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:2494" }, { "name": "RHSA-2019:2495", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:2495" }, { "name": "openSUSE-SU-2019:1912", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html" }, { "name": "openSUSE-SU-2019:1916", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html" }, { "name": "RHSA-2019:2585", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:2585" }, { "name": "RHSA-2019:2590", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:2590" }, { "name": "RHSA-2019:2592", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:2592" }, { "name": "RHSA-2019:2737", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:2737" }, { "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03977en_us" }, { "name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2021.html", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 1.6, "impactScore": 3.6 } }, "lastModifiedDate": "2022-05-23T15:02Z", "publishedDate": "2019-02-04T08:29Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.