CVE-2017-4961: BOSH Director Shell Injection Vulnerabilities | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected BOSH Release: 261.x versions prior to 261.3 All 260.x versions Description In certain cases an authenticated Director user can provide a malicious checksum that could allow them to escalate their privileges on the Director VM...

USN-3246-1: Eject vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Ilja Van Sprundel discovered that dmcrypt-get-device incorrectly checked setuid and setgid return values. A local attacker could use this issue to execute code as an administrator. Affected Cloud Foundry...

USN-3259-1: Bind vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that the resolver in Bind made incorrect assumptions about ordering when processing responses containing a CNAME or DNAME. An attacker could use this cause a denial of service...

USN-3263-1: FreeType vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that a heap-based buffer overflow existed in the FreeType library. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash,...

USN-3265-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04...

Cloud Foundry cf-release exceeds quota vulnerability

Cloud Foundry is an open source multi-cloud application platform as a service PaaS managed by the Cloud Foundry Foundation. An out-of-quota vulnerability exists in Cloud Foundry cf-release, where the "Cloud Controller" in Cloud Foundry cf-release enables a certified developer user to exceed a...

Pivotal Software Cloud Foundry Foundation BOSH Azure CPI Code Injection Vulnerability

Pivotal Software Cloud Foundry Foundation BOSH Azure CPI is a set of open source tools for deployment and lifecycle management of distributed systems from Pivotal Software, USA. A code injection vulnerability exists in version v22 of Pivotal Software Cloud Foundry Foundation BOSH Azure CPI. An...

Code injection

Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...

CVE-2016-5016

Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...

CVE-2016-5016

Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...

CVE-2016-5016

CVE-2016-5016 affects Pivotal Cloud Foundry and related UAA components: CF v239 and earlier, UAA 3.4.1 and earlier (and v12.2 and earlier), and Elastic Runtime 1.6.x before 1.6.35 / 1.7.x before 1.7.13. The root cause is that the TrustManager used by OpenJDK did not validate certificate expiratio...

CVE-2016-5016

Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...

CVE-2017-4969

The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks...

Design/Logic Flaw

The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks...

CVE-2017-4969

The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks...

CVE-2017-4969

The CVE-2017-4969 issue affects the Cloud Foundry cf-release Cloud Controller (pre-v255). A design/logic flaw allows authenticated developer users to exceed a task’s memory and disk quotas, enabling overconsumption relative to configured quotas. Impact is described as a quota-exceeding condition ...

CVE-2017-4969

The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks...

USN-2943-1 PCRE vulnerabilities | Cloud Foundry

USN-2943-1 PCRE vulnerabilities Low/Medium Vendor Canonical Ubuntu Versions Affected Ubuntu 14.04 LTS Description It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of...

CVE-2017-4973: Privilege Escalation in UAA | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v257 UAA release: 2.x versions prior to v2.7.4.14 3.6.x versions prior to v3.6.8 3.9.x versions prior to v3.9.10 Other versions prior to v3.15.0 UAA bosh release uaa-release: 13.x versions prior to v13.12...

CVE-2017-4972: Blind SQL Injection in UAA | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v257 UAA release: 2.x versions prior to v2.7.4.14 3.6.x versions prior to v3.6.8 3.9.x versions prior to v3.9.10 Other versions prior to v3.15.0 UAA bosh release uaa-release: 13.x versions prior to v13.12...