var-201401-0008
Vulnerability from variot
Xen, when using x86 Intel processors and the VMX virtualization extension is enabled, does not properly handle cpuid instruction emulation when exiting the VM, which allows local guest users to cause a denial of service (guest crash) via unspecified vectors. ( Guest crash ) There are vulnerabilities that are put into a state.Service disruption by local guest users ( Guest crash ) There is a possibility of being put into a state. Xen is prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause the guest and host operating systems to crash, denying service to legitimate users. Hitachi JP1 products are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The following products are affected: JP1/IT Resource Management - Manager JP1/IT Service Level Management - Manager.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Relevant releases/architectures:
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64
- Description:
The kernel packages contain the Linux kernel, the core of any Linux operating system.
This update fixes the following security issues:
-
An integer overflow flaw in ib_uverbs_poll_cq() could allow a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2010-4649, Important)
-
A race condition in the way new InfiniBand connections were set up could allow a remote user to cause a denial of service. (CVE-2011-0695, Important)
-
A flaw in the Stream Control Transmission Protocol (SCTP) implementation could allow a remote attacker to cause a denial of service if the sysctl "net.sctp.addip_enable" variable was turned on (it is off by default). (CVE-2011-1573, Important)
-
Flaws in the AGPGART driver implementation when handling certain IOCTL commands could allow a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2011-1745, CVE-2011-2022, Important)
-
An integer overflow flaw in agp_allocate_memory() could allow a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2011-1746, Important)
-
A flaw allowed napi_reuse_skb() to be called on VLAN (virtual LAN) packets. An attacker on the local network could trigger this flaw by sending specially-crafted packets to a target system, possibly causing a denial of service. (CVE-2011-1576, Moderate)
-
An integer signedness error in next_pidmap() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-1936, Moderate)
-
A flaw in inet_diag_bc_audit() could allow a local, unprivileged user to cause a denial of service (infinite loop). (CVE-2011-2213, Moderate)
-
A missing initialization flaw in the XFS file system implementation could lead to an information leak. (CVE-2011-0711, Low)
-
A flaw in ib_uverbs_poll_cq() could allow a local, unprivileged user to cause an information leak. (CVE-2011-1044, Low)
-
A missing validation check was found in the signals implementation. A local, unprivileged user could use this flaw to send signals via the sigqueueinfo system call, with the si_code set to SI_TKILL and with spoofed process and user IDs, to other processes. Note: This flaw does not allow existing permission checks to be bypassed; signals can only be sent if your privileges allow you to already do so. (CVE-2011-1182, Low)
-
A heap overflow flaw in the EFI GUID Partition Table (GPT) implementation could allow a local attacker to cause a denial of service by mounting a disk containing specially-crafted partition tables. (CVE-2011-1776, Low)
-
Structure padding in two structures in the Bluetooth implementation was not initialized properly before being copied to user-space, possibly allowing local, unprivileged users to leak kernel stack memory to user-space. (CVE-2011-2492, Low)
Red Hat would like to thank Jens Kuehnel for reporting CVE-2011-0695; Vasiliy Kulikov for reporting CVE-2011-1745, CVE-2011-2022, and CVE-2011-1746; Ryan Sweat for reporting CVE-2011-1576; Robert Swiecki for reporting CVE-2011-1593; Dan Rosenberg for reporting CVE-2011-2213 and CVE-2011-0711; Julien Tinnes of the Google Security Team for reporting CVE-2011-1182; Timo Warns for reporting CVE-2011-1776; and Marek Kroemeke and Filip Palian for reporting CVE-2011-2492.
Bug fix documentation will be available shortly from the Technical Notes document linked to in the References.
Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect. Solution:
Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259
To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system. Bugs fixed (http://bugzilla.redhat.com/):
653648 - CVE-2011-0695 kernel: panic in ib_cm:cm_work_handler 667916 - CVE-2010-4649 CVE-2011-1044 kernel: IB/uverbs: Handle large number of entries in poll CQ 677260 - CVE-2011-0711 kernel: xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 690028 - CVE-2011-1182 kernel signal spoofing issue 695173 - CVE-2011-1576 kernel: net: Fix memory leak/corruption on VLAN GRO_DROP 695383 - CVE-2011-1573 kernel: sctp: fix to calc the INIT/INIT-ACK chunk length correctly to set 697822 - CVE-2011-1593 kernel: proc: signedness issue in next_pidmap() 698996 - CVE-2011-1745 CVE-2011-2022 kernel: agp: insufficient pg_start parameter checking in AGPIOC_BIND and AGPIOC_UNBIND ioctls 698998 - CVE-2011-1746 kernel: agp: insufficient page_count parameter checking in agp_allocate_memory() 703019 - CVE-2011-2492 kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace 703026 - CVE-2011-1776 kernel: validate size of EFI GUID partition entries 703056 - [RHEL5.5] Panic in iscsi_sw_tcp_data_ready() [rhel-5.6.z] 706323 - CVE-2011-1936 kernel: xen: vmx: insecure cpuid vmexit 707899 - The pci resource for vf is not released after hot-removing Intel 82576 NIC [rhel-5.6.z] 711519 - GFS2: resource group bitmap corruption resulting in panics and withdraws 714536 - CVE-2011-2213 kernel: inet_diag: insufficient validation
- Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-238.19.1.el5.src.rpm
i386: kernel-2.6.18-238.19.1.el5.i686.rpm kernel-PAE-2.6.18-238.19.1.el5.i686.rpm kernel-PAE-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-PAE-devel-2.6.18-238.19.1.el5.i686.rpm kernel-debug-2.6.18-238.19.1.el5.i686.rpm kernel-debug-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-debug-devel-2.6.18-238.19.1.el5.i686.rpm kernel-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-debuginfo-common-2.6.18-238.19.1.el5.i686.rpm kernel-devel-2.6.18-238.19.1.el5.i686.rpm kernel-headers-2.6.18-238.19.1.el5.i386.rpm kernel-xen-2.6.18-238.19.1.el5.i686.rpm kernel-xen-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-xen-devel-2.6.18-238.19.1.el5.i686.rpm
noarch: kernel-doc-2.6.18-238.19.1.el5.noarch.rpm
x86_64: kernel-2.6.18-238.19.1.el5.x86_64.rpm kernel-debug-2.6.18-238.19.1.el5.x86_64.rpm kernel-debug-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm kernel-debug-devel-2.6.18-238.19.1.el5.x86_64.rpm kernel-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm kernel-debuginfo-common-2.6.18-238.19.1.el5.x86_64.rpm kernel-devel-2.6.18-238.19.1.el5.x86_64.rpm kernel-headers-2.6.18-238.19.1.el5.x86_64.rpm kernel-xen-2.6.18-238.19.1.el5.x86_64.rpm kernel-xen-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm kernel-xen-devel-2.6.18-238.19.1.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-238.19.1.el5.src.rpm
i386: kernel-2.6.18-238.19.1.el5.i686.rpm kernel-PAE-2.6.18-238.19.1.el5.i686.rpm kernel-PAE-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-PAE-devel-2.6.18-238.19.1.el5.i686.rpm kernel-debug-2.6.18-238.19.1.el5.i686.rpm kernel-debug-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-debug-devel-2.6.18-238.19.1.el5.i686.rpm kernel-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-debuginfo-common-2.6.18-238.19.1.el5.i686.rpm kernel-devel-2.6.18-238.19.1.el5.i686.rpm kernel-headers-2.6.18-238.19.1.el5.i386.rpm kernel-xen-2.6.18-238.19.1.el5.i686.rpm kernel-xen-debuginfo-2.6.18-238.19.1.el5.i686.rpm kernel-xen-devel-2.6.18-238.19.1.el5.i686.rpm
ia64: kernel-2.6.18-238.19.1.el5.ia64.rpm kernel-debug-2.6.18-238.19.1.el5.ia64.rpm kernel-debug-debuginfo-2.6.18-238.19.1.el5.ia64.rpm kernel-debug-devel-2.6.18-238.19.1.el5.ia64.rpm kernel-debuginfo-2.6.18-238.19.1.el5.ia64.rpm kernel-debuginfo-common-2.6.18-238.19.1.el5.ia64.rpm kernel-devel-2.6.18-238.19.1.el5.ia64.rpm kernel-headers-2.6.18-238.19.1.el5.ia64.rpm kernel-xen-2.6.18-238.19.1.el5.ia64.rpm kernel-xen-debuginfo-2.6.18-238.19.1.el5.ia64.rpm kernel-xen-devel-2.6.18-238.19.1.el5.ia64.rpm
noarch: kernel-doc-2.6.18-238.19.1.el5.noarch.rpm
ppc: kernel-2.6.18-238.19.1.el5.ppc64.rpm kernel-debug-2.6.18-238.19.1.el5.ppc64.rpm kernel-debug-debuginfo-2.6.18-238.19.1.el5.ppc64.rpm kernel-debug-devel-2.6.18-238.19.1.el5.ppc64.rpm kernel-debuginfo-2.6.18-238.19.1.el5.ppc64.rpm kernel-debuginfo-common-2.6.18-238.19.1.el5.ppc64.rpm kernel-devel-2.6.18-238.19.1.el5.ppc64.rpm kernel-headers-2.6.18-238.19.1.el5.ppc.rpm kernel-headers-2.6.18-238.19.1.el5.ppc64.rpm kernel-kdump-2.6.18-238.19.1.el5.ppc64.rpm kernel-kdump-debuginfo-2.6.18-238.19.1.el5.ppc64.rpm kernel-kdump-devel-2.6.18-238.19.1.el5.ppc64.rpm
s390x: kernel-2.6.18-238.19.1.el5.s390x.rpm kernel-debug-2.6.18-238.19.1.el5.s390x.rpm kernel-debug-debuginfo-2.6.18-238.19.1.el5.s390x.rpm kernel-debug-devel-2.6.18-238.19.1.el5.s390x.rpm kernel-debuginfo-2.6.18-238.19.1.el5.s390x.rpm kernel-debuginfo-common-2.6.18-238.19.1.el5.s390x.rpm kernel-devel-2.6.18-238.19.1.el5.s390x.rpm kernel-headers-2.6.18-238.19.1.el5.s390x.rpm kernel-kdump-2.6.18-238.19.1.el5.s390x.rpm kernel-kdump-debuginfo-2.6.18-238.19.1.el5.s390x.rpm kernel-kdump-devel-2.6.18-238.19.1.el5.s390x.rpm
x86_64: kernel-2.6.18-238.19.1.el5.x86_64.rpm kernel-debug-2.6.18-238.19.1.el5.x86_64.rpm kernel-debug-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm kernel-debug-devel-2.6.18-238.19.1.el5.x86_64.rpm kernel-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm kernel-debuginfo-common-2.6.18-238.19.1.el5.x86_64.rpm kernel-devel-2.6.18-238.19.1.el5.x86_64.rpm kernel-headers-2.6.18-238.19.1.el5.x86_64.rpm kernel-xen-2.6.18-238.19.1.el5.x86_64.rpm kernel-xen-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm kernel-xen-devel-2.6.18-238.19.1.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2010-4649.html https://www.redhat.com/security/data/cve/CVE-2011-0695.html https://www.redhat.com/security/data/cve/CVE-2011-0711.html https://www.redhat.com/security/data/cve/CVE-2011-1044.html https://www.redhat.com/security/data/cve/CVE-2011-1182.html https://www.redhat.com/security/data/cve/CVE-2011-1573.html https://www.redhat.com/security/data/cve/CVE-2011-1576.html https://www.redhat.com/security/data/cve/CVE-2011-1593.html https://www.redhat.com/security/data/cve/CVE-2011-1745.html https://www.redhat.com/security/data/cve/CVE-2011-1746.html https://www.redhat.com/security/data/cve/CVE-2011-1776.html https://www.redhat.com/security/data/cve/CVE-2011-1936.html https://www.redhat.com/security/data/cve/CVE-2011-2022.html https://www.redhat.com/security/data/cve/CVE-2011-2213.html https://www.redhat.com/security/data/cve/CVE-2011-2492.html https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Technical_Notes/kernel.html#RHSA-2011-0927
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2012-0001 Synopsis: VMware ESXi and ESX updates to third party library and ESX Service Console Issue date: 2012-01-30 Updated on: 2012-01-30 (initial advisory)
CVE numbers: --- COS Kernel --- CVE-2011-0726, CVE-2011-1078, CVE-2011-1079, CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166, CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494, CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649, CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182, CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745, CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022, CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525, CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495, CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 --- COS cURL --- CVE-2011-2192 --- COS rpm --- CVE-2010-2059, CVE-2011-3378 --- COS samba --- CVE-2010-0547, CVE-2010-0787, CVE-2011-1678, CVE-2011-2522, CVE-2011-2694 --- COS python --- CVE-2009-3720, CVE-2010-3493, CVE-2011-1015, CVE-2011-1521 --- python library --- CVE-2009-3560, CVE-2009-3720, CVE-2010-1634, CVE-2010-2089, CVE-2011-1521
- Summary
VMware ESXi and ESX updates to third party library and ESX Service Console address several security issues.
- Relevant releases
ESXi 4.1 without patch ESXi410-201201401-SG
ESX 4.1 without patches ESX410-201201401-SG, ESX410-201201402-SG, ESX410-201201404-SG, ESX410-201201405-SG, ESX410-201201406-SG, ESX410-201201407-SG
- Problem Description
a. ESX third party update for Service Console kernel
The ESX Service Console Operating System (COS) kernel is updated to
kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the
COS kernel.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,
CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,
CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,
CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,
CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,
CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,
CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,
CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,
CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,
CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201201401-SG
ESX 4.0 ESX patch pending
ESX 3.5 ESX not applicable
- hosted products are VMware Workstation, Player, ACE, Fusion.
b. ESX third party update for Service Console cURL RPM
The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9
resolving a security issues.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2011-2192 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201201402-SG
ESX 4.0 ESX patch pending
ESX 3.5 ESX not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion.
c. ESX third party update for Service Console nspr and nss RPMs
The ESX Service Console (COS) nspr and nss RPMs are updated to
nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving
a security issues.
A Certificate Authority (CA) issued fraudulent SSL certificates and
Netscape Portable Runtime (NSPR) and Network Security Services (NSS)
contain the built-in tokens of this fraudulent Certificate
Authority. This update renders all SSL certificates signed by the
fraudulent CA as untrusted for all uses.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201201404-SG
ESX 4.0 ESX patch pending
ESX 3.5 ESX not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion.
d. ESX third party update for Service Console rpm RPMs
The ESX Service Console Operating System (COS) rpm packages are
updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,
rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2
which fixes multiple security issues.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2010-2059 and CVE-2011-3378 to these issues.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201201406-SG
ESX 4.0 ESX patch pending
ESX 3.5 ESX not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion.
e. ESX third party update for Service Console samba RPMs
The ESX Service Console Operating System (COS) samba packages are
updated to samba-client-3.0.33-3.29.el5_7.4,
samba-common-3.0.33-3.29.el5_7.4 and
libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security
issues in the Samba client.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,
CVE-2011-2522 and CVE-2011-2694 to these issues.
Note that ESX does not include the Samba Web Administration Tool
(SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and
CVE-2011-2694.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201201407-SG
ESX 4.0 ESX patch pending
ESX 3.5 ESX not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion.
f. ESX third party update for Service Console python package
The ESX Service Console (COS) python package is updated to
2.4.3-44 which fixes multiple security issues.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and
CVE-2011-1521 to these issues.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201201405-SG
ESX 4.0 ESX patch pending
ESX 3.5 ESX not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion.
g. ESXi update to third party component python
The python third party library is updated to python 2.5.6 which
fixes multiple security issues.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,
CVE-2010-2089, and CVE-2011-1521 to these issues.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi 5.0 ESXi patch pending
ESXi 4.1 ESXi ESXi410-201201401-SG
ESXi 4.0 ESXi patch pending
ESXi 3.5 ESXi patch pending
ESX 4.1 ESX not affected
ESX 4.0 ESX not affected
ESX 3.5 ESX not affected
* hosted products are VMware Workstation, Player, ACE, Fusion.
- Solution
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
VMware ESXi 4.1
ESXi410-201201401
http://downloads.vmware.com/go/selfsupport-download
md5sum: BDF86F10A973346E26C9C2CD4C424E88
sha1sum: CC0B92869A9AAE4F5E0E5B81BEE109BCD7DA780F
http://kb.vmware.com/kb/2009143
ESXi410-201201401 contains ESXi410-201201401-SG
VMware ESX 4.1
ESX410-201201001
http://downloads.vmware.com/go/selfsupport-download
md5sum: 16DF9ACD3E74BCABC2494BC23AD0927F
sha1sum: 1066AE1436E1A75BA3D541AB65296CFB9AB7A5CC
http://kb.vmware.com/kb/2009142
ESX410-201201001 contains ESX410-201201401-SG, ESX410-201201402-SG, ESX410-201201404-SG, ESX410-201201405-SG, ESX410-201201406-SG and ESX410-201201407-SG
- References
CVE numbers
--- COS Kernel --- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0726 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1078 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1079 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1080 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1093 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1163 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1166 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1170 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1171 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1172 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1494 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1495 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1577 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1763 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4649 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0695 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0711 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1044 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1182 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1573 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1576 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1593 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1745 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1746 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1776 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1936 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2022 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2213 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2492 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1780 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2525 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2482 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2491 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2495 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2517 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2519 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2901 --- COS cURL --- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2192 --- COS rpm --- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2059 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3378 --- COS samba --- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0547 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0787 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1678 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2522 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2694 --- COS python --- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3493 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1015 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1521 --- python library --- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1634 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2089 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1521
- Change log
2012-01-30 VMSA-2012-0001 Initial security advisory in conjunction with the release of patches for ESX 4.1 and ESXi 4.1 on 2012-01-30.
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories http://www.vmware.com/security/advisories
VMware security response policy http://www.vmware.com/support/policies/security_response.html
General support life cycle policy http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html
Copyright 2012 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.8.3 (Build 4028) Charset: utf-8
wj8DBQFPJ5DIDEcm8Vbi9kMRAnzCAKCmaAoDp49d61Mr1emzh/U0N8vbgACdFZk8 f2pLxi537s+ew4dvnYNWlJ8= =OAh4 -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0008",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "xen",
"scope": "eq",
"trust": 1.9,
"vendor": "xen",
"version": null
},
{
"model": "xen",
"scope": null,
"trust": 0.8,
"vendor": "xen",
"version": null
},
{
"model": "aura session manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "project openvz 028stab089.1",
"scope": null,
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "linux enterprise desktop sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.3"
},
{
"model": "voice portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "project openvz 028stab085.2",
"scope": null,
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.2"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "project openvz 028stab091.1",
"scope": null,
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "hat enterprise linux desktop client",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "linux enterprise sdk sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.1"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.3"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura system platform sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura system platform sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "project openvz 028stab081.1",
"scope": null,
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.2"
},
{
"model": "hat enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "linux enterprise server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "xen",
"scope": "eq",
"trust": 0.3,
"vendor": "xensource",
"version": "0"
},
{
"model": "voice portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "aura application server sip core",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.1"
},
{
"model": "project openvz 2.6.32-feoktistov.1",
"scope": null,
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "voice portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "project openvz",
"scope": "eq",
"trust": 0.3,
"vendor": "openvz",
"version": "2.6.32"
},
{
"model": "project openvz 023stab053.2",
"scope": null,
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "linux enterprise server sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "project openvz 023stab054.1",
"scope": null,
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5.0"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.2"
},
{
"model": "linux enterprise sdk sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "aura system manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "project openvz 028stab092.2",
"scope": "ne",
"trust": 0.3,
"vendor": "openvz",
"version": null
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura system manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.2"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "aura conferencing standard",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura communication manager utility services",
"scope": "ne",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "aura system manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "aura session manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "aura communication manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "aura session manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.3"
},
{
"model": "aura session manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "jp1/it service level management manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "-09-50"
},
{
"model": "jp1/it resource management-manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-50"
},
{
"model": "jp1/it resource management-manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-11-02"
},
{
"model": "jp1/it resource management-manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-11"
},
{
"model": "jp1/it resource management-manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-10-03"
},
{
"model": "jp1/it resource management-manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-10"
},
{
"model": "jp1/it service level management-manager",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-51"
},
{
"model": "jp1/it resource management-manager",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-50-02"
},
{
"model": "jp1/it resource management-manager",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": "09-11-05"
}
],
"sources": [
{
"db": "BID",
"id": "48610"
},
{
"db": "BID",
"id": "78462"
},
{
"db": "BID",
"id": "51749"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-091"
},
{
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:xen:xen",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hitachi",
"sources": [
{
"db": "BID",
"id": "51749"
},
{
"db": "CNNVD",
"id": "CNNVD-201201-419"
}
],
"trust": 0.9
},
"cve": "CVE-2011-1936",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 4.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.2,
"id": "CVE-2011-1936",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 4.9,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2011-1936",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-1936",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-1936",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201401-091",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-091"
},
{
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Xen, when using x86 Intel processors and the VMX virtualization extension is enabled, does not properly handle cpuid instruction emulation when exiting the VM, which allows local guest users to cause a denial of service (guest crash) via unspecified vectors. ( Guest crash ) There are vulnerabilities that are put into a state.Service disruption by local guest users ( Guest crash ) There is a possibility of being put into a state. Xen is prone to multiple denial-of-service vulnerabilities. \nAttackers can exploit these issues to cause the guest and host operating systems to crash, denying service to legitimate users. Hitachi JP1 products are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. \nThe following products are affected:\nJP1/IT Resource Management - Manager\nJP1/IT Service Level Management - Manager. \n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section. Relevant releases/architectures:\n\nRed Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64\nRed Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64\n\n3. Description:\n\nThe kernel packages contain the Linux kernel, the core of any Linux\noperating system. \n\nThis update fixes the following security issues:\n\n* An integer overflow flaw in ib_uverbs_poll_cq() could allow a local,\nunprivileged user to cause a denial of service or escalate their\nprivileges. (CVE-2010-4649, Important)\n\n* A race condition in the way new InfiniBand connections were set up could\nallow a remote user to cause a denial of service. (CVE-2011-0695,\nImportant)\n\n* A flaw in the Stream Control Transmission Protocol (SCTP) implementation\ncould allow a remote attacker to cause a denial of service if the sysctl\n\"net.sctp.addip_enable\" variable was turned on (it is off by default). \n(CVE-2011-1573, Important)\n\n* Flaws in the AGPGART driver implementation when handling certain IOCTL\ncommands could allow a local, unprivileged user to cause a denial of\nservice or escalate their privileges. (CVE-2011-1745, CVE-2011-2022,\nImportant)\n\n* An integer overflow flaw in agp_allocate_memory() could allow a local,\nunprivileged user to cause a denial of service or escalate their\nprivileges. (CVE-2011-1746, Important)\n\n* A flaw allowed napi_reuse_skb() to be called on VLAN (virtual LAN)\npackets. An attacker on the local network could trigger this flaw by\nsending specially-crafted packets to a target system, possibly causing a\ndenial of service. (CVE-2011-1576, Moderate)\n\n* An integer signedness error in next_pidmap() could allow a local,\nunprivileged user to cause a denial of service. \n(CVE-2011-1936, Moderate)\n\n* A flaw in inet_diag_bc_audit() could allow a local, unprivileged user to\ncause a denial of service (infinite loop). (CVE-2011-2213, Moderate)\n\n* A missing initialization flaw in the XFS file system implementation\ncould lead to an information leak. (CVE-2011-0711, Low)\n\n* A flaw in ib_uverbs_poll_cq() could allow a local, unprivileged user to\ncause an information leak. (CVE-2011-1044, Low)\n\n* A missing validation check was found in the signals implementation. A\nlocal, unprivileged user could use this flaw to send signals via the\nsigqueueinfo system call, with the si_code set to SI_TKILL and with spoofed\nprocess and user IDs, to other processes. Note: This flaw does not allow\nexisting permission checks to be bypassed; signals can only be sent if your\nprivileges allow you to already do so. (CVE-2011-1182, Low)\n\n* A heap overflow flaw in the EFI GUID Partition Table (GPT) implementation\ncould allow a local attacker to cause a denial of service by mounting a\ndisk containing specially-crafted partition tables. (CVE-2011-1776, Low)\n\n* Structure padding in two structures in the Bluetooth implementation\nwas not initialized properly before being copied to user-space, possibly\nallowing local, unprivileged users to leak kernel stack memory to\nuser-space. (CVE-2011-2492, Low)\n\nRed Hat would like to thank Jens Kuehnel for reporting CVE-2011-0695;\nVasiliy Kulikov for reporting CVE-2011-1745, CVE-2011-2022, and\nCVE-2011-1746; Ryan Sweat for reporting CVE-2011-1576; Robert Swiecki for\nreporting CVE-2011-1593; Dan Rosenberg for reporting CVE-2011-2213 and\nCVE-2011-0711; Julien Tinnes of the Google Security Team for reporting\nCVE-2011-1182; Timo Warns for reporting CVE-2011-1776; and Marek Kroemeke\nand Filip Palian for reporting CVE-2011-2492. \n\nBug fix documentation will be available shortly from the Technical Notes\ndocument linked to in the References. \n\nUsers should upgrade to these updated packages, which contain backported\npatches to correct these issues, and fix the bugs noted in the Technical\nNotes. The system must be rebooted for this update to take effect. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not\nuse \"rpm -Uvh\" as that will remove the running kernel binaries from\nyour system. You may use \"rpm -e\" to remove old kernels after\ndetermining that the new kernel functions properly on your system. Bugs fixed (http://bugzilla.redhat.com/):\n\n653648 - CVE-2011-0695 kernel: panic in ib_cm:cm_work_handler\n667916 - CVE-2010-4649 CVE-2011-1044 kernel: IB/uverbs: Handle large number of entries in poll CQ\n677260 - CVE-2011-0711 kernel: xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1\n690028 - CVE-2011-1182 kernel signal spoofing issue\n695173 - CVE-2011-1576 kernel: net: Fix memory leak/corruption on VLAN GRO_DROP\n695383 - CVE-2011-1573 kernel: sctp: fix to calc the INIT/INIT-ACK chunk length correctly to set\n697822 - CVE-2011-1593 kernel: proc: signedness issue in next_pidmap()\n698996 - CVE-2011-1745 CVE-2011-2022 kernel: agp: insufficient pg_start parameter checking in AGPIOC_BIND and AGPIOC_UNBIND ioctls\n698998 - CVE-2011-1746 kernel: agp: insufficient page_count parameter checking in agp_allocate_memory()\n703019 - CVE-2011-2492 kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace\n703026 - CVE-2011-1776 kernel: validate size of EFI GUID partition entries\n703056 - [RHEL5.5] Panic in iscsi_sw_tcp_data_ready() [rhel-5.6.z]\n706323 - CVE-2011-1936 kernel: xen: vmx: insecure cpuid vmexit\n707899 - The pci resource for vf is not released after hot-removing Intel 82576 NIC [rhel-5.6.z]\n711519 - GFS2: resource group bitmap corruption resulting in panics and withdraws\n714536 - CVE-2011-2213 kernel: inet_diag: insufficient validation\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 5 client):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-238.19.1.el5.src.rpm\n\ni386:\nkernel-2.6.18-238.19.1.el5.i686.rpm\nkernel-PAE-2.6.18-238.19.1.el5.i686.rpm\nkernel-PAE-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-PAE-devel-2.6.18-238.19.1.el5.i686.rpm\nkernel-debug-2.6.18-238.19.1.el5.i686.rpm\nkernel-debug-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-debug-devel-2.6.18-238.19.1.el5.i686.rpm\nkernel-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-debuginfo-common-2.6.18-238.19.1.el5.i686.rpm\nkernel-devel-2.6.18-238.19.1.el5.i686.rpm\nkernel-headers-2.6.18-238.19.1.el5.i386.rpm\nkernel-xen-2.6.18-238.19.1.el5.i686.rpm\nkernel-xen-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-xen-devel-2.6.18-238.19.1.el5.i686.rpm\n\nnoarch:\nkernel-doc-2.6.18-238.19.1.el5.noarch.rpm\n\nx86_64:\nkernel-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debug-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debug-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debug-devel-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debuginfo-common-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-devel-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-headers-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-xen-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-xen-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-xen-devel-2.6.18-238.19.1.el5.x86_64.rpm\n\nRed Hat Enterprise Linux (v. 5 server):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-238.19.1.el5.src.rpm\n\ni386:\nkernel-2.6.18-238.19.1.el5.i686.rpm\nkernel-PAE-2.6.18-238.19.1.el5.i686.rpm\nkernel-PAE-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-PAE-devel-2.6.18-238.19.1.el5.i686.rpm\nkernel-debug-2.6.18-238.19.1.el5.i686.rpm\nkernel-debug-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-debug-devel-2.6.18-238.19.1.el5.i686.rpm\nkernel-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-debuginfo-common-2.6.18-238.19.1.el5.i686.rpm\nkernel-devel-2.6.18-238.19.1.el5.i686.rpm\nkernel-headers-2.6.18-238.19.1.el5.i386.rpm\nkernel-xen-2.6.18-238.19.1.el5.i686.rpm\nkernel-xen-debuginfo-2.6.18-238.19.1.el5.i686.rpm\nkernel-xen-devel-2.6.18-238.19.1.el5.i686.rpm\n\nia64:\nkernel-2.6.18-238.19.1.el5.ia64.rpm\nkernel-debug-2.6.18-238.19.1.el5.ia64.rpm\nkernel-debug-debuginfo-2.6.18-238.19.1.el5.ia64.rpm\nkernel-debug-devel-2.6.18-238.19.1.el5.ia64.rpm\nkernel-debuginfo-2.6.18-238.19.1.el5.ia64.rpm\nkernel-debuginfo-common-2.6.18-238.19.1.el5.ia64.rpm\nkernel-devel-2.6.18-238.19.1.el5.ia64.rpm\nkernel-headers-2.6.18-238.19.1.el5.ia64.rpm\nkernel-xen-2.6.18-238.19.1.el5.ia64.rpm\nkernel-xen-debuginfo-2.6.18-238.19.1.el5.ia64.rpm\nkernel-xen-devel-2.6.18-238.19.1.el5.ia64.rpm\n\nnoarch:\nkernel-doc-2.6.18-238.19.1.el5.noarch.rpm\n\nppc:\nkernel-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-debug-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-debug-debuginfo-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-debug-devel-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-debuginfo-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-debuginfo-common-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-devel-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-headers-2.6.18-238.19.1.el5.ppc.rpm\nkernel-headers-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-kdump-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-kdump-debuginfo-2.6.18-238.19.1.el5.ppc64.rpm\nkernel-kdump-devel-2.6.18-238.19.1.el5.ppc64.rpm\n\ns390x:\nkernel-2.6.18-238.19.1.el5.s390x.rpm\nkernel-debug-2.6.18-238.19.1.el5.s390x.rpm\nkernel-debug-debuginfo-2.6.18-238.19.1.el5.s390x.rpm\nkernel-debug-devel-2.6.18-238.19.1.el5.s390x.rpm\nkernel-debuginfo-2.6.18-238.19.1.el5.s390x.rpm\nkernel-debuginfo-common-2.6.18-238.19.1.el5.s390x.rpm\nkernel-devel-2.6.18-238.19.1.el5.s390x.rpm\nkernel-headers-2.6.18-238.19.1.el5.s390x.rpm\nkernel-kdump-2.6.18-238.19.1.el5.s390x.rpm\nkernel-kdump-debuginfo-2.6.18-238.19.1.el5.s390x.rpm\nkernel-kdump-devel-2.6.18-238.19.1.el5.s390x.rpm\n\nx86_64:\nkernel-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debug-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debug-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debug-devel-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-debuginfo-common-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-devel-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-headers-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-xen-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-xen-debuginfo-2.6.18-238.19.1.el5.x86_64.rpm\nkernel-xen-devel-2.6.18-238.19.1.el5.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and \ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2010-4649.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-0695.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-0711.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1044.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1182.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1573.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1576.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1593.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1745.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1746.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1776.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-1936.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-2022.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-2213.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-2492.html\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Technical_Notes/kernel.html#RHSA-2011-0927\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n ----------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2012-0001\nSynopsis: VMware ESXi and ESX updates to third party library\n and ESX Service Console\nIssue date: 2012-01-30\nUpdated on: 2012-01-30 (initial advisory)\n\nCVE numbers: --- COS Kernel ---\n CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,\n CVE-2011-1080, CVE-2011-1093, CVE-2011-1163,\n CVE-2011-1166, CVE-2011-1170, CVE-2011-1171,\n CVE-2011-1172, CVE-2011-1494, CVE-2011-1495,\n CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,\n CVE-2011-0695, CVE-2011-0711, CVE-2011-1044,\n CVE-2011-1182, CVE-2011-1573, CVE-2011-1576,\n CVE-2011-1593, CVE-2011-1745, CVE-2011-1746,\n CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,\n CVE-2011-2213, CVE-2011-2492, CVE-2011-1780,\n CVE-2011-2525, CVE-2011-2689, CVE-2011-2482,\n CVE-2011-2491, CVE-2011-2495, CVE-2011-2517,\n CVE-2011-2519, CVE-2011-2901\n --- COS cURL ---\n CVE-2011-2192\n --- COS rpm ---\n CVE-2010-2059, CVE-2011-3378\n --- COS samba ---\n CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,\n CVE-2011-2522, CVE-2011-2694\n --- COS python ---\n CVE-2009-3720, CVE-2010-3493, CVE-2011-1015,\n CVE-2011-1521\n --- python library ---\n CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,\n CVE-2010-2089, CVE-2011-1521\n ----------------------------------------------------------------------\n\n1. Summary\n\n VMware ESXi and ESX updates to third party library and ESX Service\n Console address several security issues. \n\n2. Relevant releases\n\n ESXi 4.1 without patch ESXi410-201201401-SG\n\n ESX 4.1 without patches ESX410-201201401-SG, ESX410-201201402-SG,\n ESX410-201201404-SG, ESX410-201201405-SG,\n ESX410-201201406-SG, ESX410-201201407-SG\n\n3. Problem Description\n\n a. ESX third party update for Service Console kernel\n\n The ESX Service Console Operating System (COS) kernel is updated to\n kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the\n COS kernel. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,\n CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,\n CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,\n CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,\n CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,\n CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,\n CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,\n CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,\n CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,\n CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCenter any Windows not affected\n\n hosted * any any not affected\n\n ESXi any ESXi not affected\n\n ESX 4.1 ESX ESX410-201201401-SG\n ESX 4.0 ESX patch pending\n ESX 3.5 ESX not applicable\n\n * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n b. ESX third party update for Service Console cURL RPM\n\n The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9\n resolving a security issues. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the name CVE-2011-2192 to this issue. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCenter any Windows not affected\n\n hosted * any any not affected\n\n ESXi any ESXi not affected\n\n ESX 4.1 ESX ESX410-201201402-SG\n ESX 4.0 ESX patch pending\n ESX 3.5 ESX not applicable\n\n * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n c. ESX third party update for Service Console nspr and nss RPMs\n\n The ESX Service Console (COS) nspr and nss RPMs are updated to\n nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving\n a security issues. \n\n A Certificate Authority (CA) issued fraudulent SSL certificates and\n Netscape Portable Runtime (NSPR) and Network Security Services (NSS)\n contain the built-in tokens of this fraudulent Certificate\n Authority. This update renders all SSL certificates signed by the\n fraudulent CA as untrusted for all uses. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCenter any Windows not affected\n\n hosted * any any not affected\n\n ESXi any ESXi not affected\n\n ESX 4.1 ESX ESX410-201201404-SG\n ESX 4.0 ESX patch pending\n ESX 3.5 ESX not applicable\n\n * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n d. ESX third party update for Service Console rpm RPMs\n\n The ESX Service Console Operating System (COS) rpm packages are\n updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,\n rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2\n which fixes multiple security issues. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2010-2059 and CVE-2011-3378 to these issues. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCenter any Windows not affected\n\n hosted * any any not affected\n\n ESXi any ESXi not affected\n\n ESX 4.1 ESX ESX410-201201406-SG\n ESX 4.0 ESX patch pending\n ESX 3.5 ESX not applicable\n\n * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n\n e. ESX third party update for Service Console samba RPMs\n\n The ESX Service Console Operating System (COS) samba packages are\n updated to samba-client-3.0.33-3.29.el5_7.4,\n samba-common-3.0.33-3.29.el5_7.4 and\n libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security\n issues in the Samba client. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,\n CVE-2011-2522 and CVE-2011-2694 to these issues. \n\n Note that ESX does not include the Samba Web Administration Tool\n (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and\n CVE-2011-2694. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCenter any Windows not affected\n\n hosted * any any not affected\n\n ESXi any ESXi not affected\n\n ESX 4.1 ESX ESX410-201201407-SG\n ESX 4.0 ESX patch pending\n ESX 3.5 ESX not applicable\n\n * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n f. ESX third party update for Service Console python package\n\n The ESX Service Console (COS) python package is updated to\n 2.4.3-44 which fixes multiple security issues. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and\n CVE-2011-1521 to these issues. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCenter any Windows not affected\n\n hosted * any any not affected\n\n ESXi any ESXi not affected\n\n ESX 4.1 ESX ESX410-201201405-SG\n ESX 4.0 ESX patch pending\n ESX 3.5 ESX not applicable\n\n * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n g. ESXi update to third party component python\n\n The python third party library is updated to python 2.5.6 which\n fixes multiple security issues. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,\n CVE-2010-2089, and CVE-2011-1521 to these issues. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCenter any Windows not affected\n\n hosted * any any not affected\n\n ESXi 5.0 ESXi patch pending\n ESXi 4.1 ESXi ESXi410-201201401-SG\n ESXi 4.0 ESXi patch pending\n ESXi 3.5 ESXi patch pending\n\n ESX 4.1 ESX not affected\n ESX 4.0 ESX not affected\n ESX 3.5 ESX not affected\n\n * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n\n4. Solution\n\n Please review the patch/release notes for your product and version\n and verify the checksum of your downloaded file. \n\n VMware ESXi 4.1\n ---------------\n ESXi410-201201401\n http://downloads.vmware.com/go/selfsupport-download\n md5sum: BDF86F10A973346E26C9C2CD4C424E88 \n sha1sum: CC0B92869A9AAE4F5E0E5B81BEE109BCD7DA780F\n http://kb.vmware.com/kb/2009143\n ESXi410-201201401 contains ESXi410-201201401-SG\n\n VMware ESX 4.1\n --------------\n ESX410-201201001\n http://downloads.vmware.com/go/selfsupport-download\n md5sum: 16DF9ACD3E74BCABC2494BC23AD0927F \n sha1sum: 1066AE1436E1A75BA3D541AB65296CFB9AB7A5CC\n http://kb.vmware.com/kb/2009142\n\n ESX410-201201001 contains ESX410-201201401-SG, ESX410-201201402-SG,\n ESX410-201201404-SG, ESX410-201201405-SG, ESX410-201201406-SG and\n ESX410-201201407-SG\n\n5. References\n\n CVE numbers\n\n --- COS Kernel ---\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0726\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1078\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1079\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1080\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1093\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1163\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1166\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1170\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1171\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1172\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1494\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1495\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1577\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1763\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4649\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0695\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0711\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1044\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1182\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1573\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1576\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1593\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1745\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1746\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1776\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1936\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2022\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2213\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2492\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1780\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2525\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2689\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2482\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2491\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2495\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2517\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2519\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2901\n --- COS cURL ---\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2192\n --- COS rpm ---\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2059\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3378\n --- COS samba ---\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0547\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0787\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1678\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2522\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2694\n --- COS python ---\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3493\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1015\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1521\n --- python library ---\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1634\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2089\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1521\n\n ----------------------------------------------------------------------\n\n6. Change log\n\n 2012-01-30 VMSA-2012-0001\n Initial security advisory in conjunction with the release of patches\n for ESX 4.1 and ESXi 4.1 on 2012-01-30. \n\n ----------------------------------------------------------------------\n\n7. Contact\n\nE-mail list for product security notifications and announcements:\nhttp://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\nThis Security Advisory is posted to the following lists:\n\n * security-announce at lists.vmware.com\n * bugtraq at securityfocus.com\n * full-disclosure at lists.grok.org.uk\n\nE-mail: security at vmware.com\nPGP key at: http://kb.vmware.com/kb/1055\n\nVMware Security Advisories\nhttp://www.vmware.com/security/advisories\n\nVMware security response policy\nhttp://www.vmware.com/support/policies/security_response.html\n\nGeneral support life cycle policy\nhttp://www.vmware.com/support/policies/eos.html\n\nVMware Infrastructure support life cycle policy\nhttp://www.vmware.com/support/policies/eos_vi.html\n\nCopyright 2012 VMware Inc. All rights reserved. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: PGP Desktop 9.8.3 (Build 4028)\nCharset: utf-8\n\nwj8DBQFPJ5DIDEcm8Vbi9kMRAnzCAKCmaAoDp49d61Mr1emzh/U0N8vbgACdFZk8\nf2pLxi537s+ew4dvnYNWlJ8=\n=OAh4\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-1936"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"db": "BID",
"id": "48610"
},
{
"db": "BID",
"id": "78462"
},
{
"db": "BID",
"id": "51749"
},
{
"db": "PACKETSTORM",
"id": "103081"
},
{
"db": "PACKETSTORM",
"id": "109299"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-1936",
"trust": 3.2
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2011/07/07/3",
"trust": 2.7
},
{
"db": "BID",
"id": "51749",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-005257",
"trust": 0.8
},
{
"db": "REDHAT",
"id": "RHSA-2011:0927",
"trust": 0.6
},
{
"db": "SECUNIA",
"id": "45391",
"trust": 0.6
},
{
"db": "SECUNIA",
"id": "45704",
"trust": 0.6
},
{
"db": "SECUNIA",
"id": "47804",
"trust": 0.6
},
{
"db": "SECUNIA",
"id": "50684",
"trust": 0.6
},
{
"db": "SECUNIA",
"id": "45253",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[OSS-SECURITY] 20110707 CVE-2011-1780, CVE-2011-1936, KERNEL/XEN ISSUES",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201401-091",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201201-419",
"trust": 0.6
},
{
"db": "BID",
"id": "48610",
"trust": 0.3
},
{
"db": "BID",
"id": "78462",
"trust": 0.3
},
{
"db": "HITACHI",
"id": "HS12-005",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "103081",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "109299",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "48610"
},
{
"db": "BID",
"id": "78462"
},
{
"db": "BID",
"id": "51749"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"db": "PACKETSTORM",
"id": "103081"
},
{
"db": "PACKETSTORM",
"id": "109299"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-091"
},
{
"db": "CNNVD",
"id": "CNNVD-201201-419"
},
{
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"id": "VAR-201401-0008",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.225
},
"last_update_date": "2024-10-16T21:25:35.782000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Bug 706323",
"trust": 0.8,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1936"
},
{
"title": "RHSA-2011:0927",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/RHSA-2011-0927.html"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.xenproject.org/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.openwall.com/lists/oss-security/2011/07/07/3"
},
{
"trust": 2.0,
"url": "http://rhn.redhat.com/errata/rhsa-2011-0927.html"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1936"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-1936"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/45253"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/45391"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/45704"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/47804"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/50684"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/51749"
},
{
"trust": 0.3,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2011-1780"
},
{
"trust": 0.3,
"url": "http://permalink.gmane.org/gmane.comp.security.oss.general/5435"
},
{
"trust": 0.3,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2011-1936"
},
{
"trust": 0.3,
"url": "http://wiki.openvz.org/download/kernel/rhel5/028stab092.2"
},
{
"trust": 0.3,
"url": "http://xen.xensource.com/"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100147390"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100148240"
},
{
"trust": 0.3,
"url": "http://www.hds.com/products/storage-software/hitachi-device-manager.html"
},
{
"trust": 0.3,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-005/index.html"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0711"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1182"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4649"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0695"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1573"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1044"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1776.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1936.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/kb/docs/doc-11259"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1593"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-0711.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2010-4649.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2492"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1593.html"
},
{
"trust": 0.1,
"url": "https://docs.redhat.com/docs/en-us/red_hat_enterprise_linux/5/html/5.6_technical_notes/kernel.html#rhsa-2011-0927"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-2492.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1745"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1746.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-2213.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2022"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1936"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1776"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1044.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-0695.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1745.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2213"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1573.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1576.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1746"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.1,
"url": "http://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-2022.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1576"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1182.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2495"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2901"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2522"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1166"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1015"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1163"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1573"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1093"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1780"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2525"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1746"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1055"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2192"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4649"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1078"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1170"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1745"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1015"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3560"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1163"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1494"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2689"
},
{
"trust": 0.1,
"url": "http://downloads.vmware.com/go/selfsupport-download"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/eos_vi.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2519"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0726"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3560"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/2009143"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1763"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1166"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1044"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2482"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-3493"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1078"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1521"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0711"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1171"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2213"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/eos.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1079"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0547"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0787"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1521"
},
{
"trust": 0.1,
"url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1577"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2491"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2059"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1172"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1172"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0726"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/security/advisories"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2089"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3720"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1678"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1182"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1080"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1080"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1634"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/support/policies/security_response.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1494"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0787"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0695"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2517"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1079"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3720"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/2009142"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2022"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1593"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1170"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2089"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2694"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0547"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2492"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2059"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1495"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1093"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3493"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1576"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3378"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1634"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1171"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1495"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1776"
}
],
"sources": [
{
"db": "BID",
"id": "48610"
},
{
"db": "BID",
"id": "78462"
},
{
"db": "BID",
"id": "51749"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"db": "PACKETSTORM",
"id": "103081"
},
{
"db": "PACKETSTORM",
"id": "109299"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-091"
},
{
"db": "CNNVD",
"id": "CNNVD-201201-419"
},
{
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "48610"
},
{
"db": "BID",
"id": "78462"
},
{
"db": "BID",
"id": "51749"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"db": "PACKETSTORM",
"id": "103081"
},
{
"db": "PACKETSTORM",
"id": "109299"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-091"
},
{
"db": "CNNVD",
"id": "CNNVD-201201-419"
},
{
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-07-07T00:00:00",
"db": "BID",
"id": "48610"
},
{
"date": "2014-01-07T00:00:00",
"db": "BID",
"id": "78462"
},
{
"date": "2012-01-31T00:00:00",
"db": "BID",
"id": "51749"
},
{
"date": "2014-01-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"date": "2011-07-15T13:41:16",
"db": "PACKETSTORM",
"id": "103081"
},
{
"date": "2012-01-30T12:12:00",
"db": "PACKETSTORM",
"id": "109299"
},
{
"date": "2014-01-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-091"
},
{
"date": "1900-01-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201201-419"
},
{
"date": "2014-01-07T19:55:05.953000",
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-27T14:54:00",
"db": "BID",
"id": "48610"
},
{
"date": "2014-01-07T00:00:00",
"db": "BID",
"id": "78462"
},
{
"date": "2012-01-31T00:00:00",
"db": "BID",
"id": "51749"
},
{
"date": "2014-01-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-005257"
},
{
"date": "2014-01-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-091"
},
{
"date": "2012-02-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201201-419"
},
{
"date": "2014-02-25T14:10:57.950000",
"db": "NVD",
"id": "CVE-2011-1936"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "78462"
},
{
"db": "BID",
"id": "51749"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Xen Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-005257"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input Validation Error",
"sources": [
{
"db": "BID",
"id": "78462"
},
{
"db": "BID",
"id": "51749"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.