CVE-2016-4435 BOSH Agent Anonymous Endpoint | Cloud Foundry

CVE-2016-4435 BOSH Agent Anonymous Endpoint Medium Vendor Cloud Foundry Foundation Versions Affected BOSH stemcell versions prior to 3232.6 and 3146.13 Description An endpoint of the Agent running on the BOSH Director VM may allow unauthenticated clients to read or write blobs or cause a denial o...

USN-2987-1 GD library vulnerabilities | Cloud Foundry

USN-2987-1 GD library vulnerabilities Medium Vendor libgd2, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that the GD library incorrectly handled certain color tables in XPM images. If a user or automated system were tricked into processing a speciall...

USN-2994-1 libxml2 vulnerabilities | Cloud Foundry

USN-2994-1 libxml2 vulnerabilities Medium Vendor GNOME XML library, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Multiple researchers discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a...

USN-2990-1 ImageMagick vulnerability (a.k.a. ImageTragick) | Cloud Foundry

USN-2990-1 ImageMagick vulnerability a.k.a. ImageTragick Medium Vendor Imagemagick, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly sanitized untrusted input. A remote attacker could use these issues to...

USN-2961-1 Little CMS vulnerability | Cloud Foundry

USN-2961-1 Little CMS vulnerability Medium Vendor Little CMS, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that a double free could occur when the intent handling code in the Little CMS library detected an error. An attacker could use this to special...

USN-2985-2 GNU C Library regression | Cloud Foundry

USN-2985-2 GNU C Library regression Medium Vendor GNU C, Canonical Ubuntu Versions Affected Ubuntu 14.04 LTS Description USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for CVE-2014-9761 introduced a regression which affected applications that use the libm library but were not full...

USN-2983-1 Expat vulnerability | Cloud Foundry

USN-2983-1 Expat vulnerability Medium Vendor Expat, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Gustavo Grieco discovered that Expat incorrectly handled malformed XML data. If a user or application linked against Expat were tricked into opening a crafted XML file, an...

USN-2981-1 libarchive vulnerabilities | Cloud Foundry

USN-2981-1 libarchive vulnerabilities Medium Vendor Libarchive, Canonical Ubuntu Versions Affected Ubuntu 14.04 LTS Description It was discovered that libarchive incorrectly handled certain entry-size values in ZIP archives. A remote attacker could use this issue to cause libarchive to crash,...

USN-2966-1 OpenSSH vulnerabilities | Cloud Foundry

USN-2966-1 OpenSSH vulnerabilities Low Vendor Canonical Ubuntu, openssh Versions Affected Canonical Ubuntu 14.04 LTS Description Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain...

CVE-2013-7456 and CVE-2016-5093 PHP vulnerabilities | Cloud Foundry

CVE-2013-7456 and CVE-2016-5093 PHP vulnerabilities Low Vendor PHP Versions Affected Cloud Foundry PHP buildpack versions prior to 4.3.14 Description Several out-of-bounds reads were discovered in PHP and its dependencies that could cause memory leaks or other unexpected conditions. Mitigation...

CVE-2016-3084 UAA Password Reset Vulnerability | Cloud Foundry

CVE-2016-3084 UAA Password Reset Vulnerability Low Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v236 and earlier versions UAA release v3.3.0 and earlier versions All versions of Login-server UAA release v10 and earlier versions Description The UAA reset password flow is...

Pivotal Software Cloud Foundry Diego Component Denial of Service Vulnerability

Pivotal Software Cloud Foundry is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software, U.S. Diego is one of the components responsible for scheduling and running tasks and daemons. A denial of service vulnerability exists in the Diego component of Pivotal...

USN-2977-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN-2977-1 Linux kernel Vivid HWE vulnerabilities High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Philip Pettersson discovered that the Linux kernel’s ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local...

CVE-2016-3091 Diego log encoding vulnerability | Cloud Foundry

CVE-2016-3091 Diego log encoding vulnerability High Vendor Cloud Foundry Foundation Versions Affected Diego-release versions 0.1468.0 through 0.1470.0 Description Due to how Diego handles breaking up large log streams on UTF-8 boundaries, it is possible to cause a denial of service on a Cloud...

USN-2935-2 PAM regression | Cloud Foundry

USN-2935-2 PAM regression Low Vendor Ubuntu Versions Affected Ubuntu 14.04 LTS Description USN-2935-1 fixed vulnerabilities in PAM. The updates contained a packaging change that prevented upgrades in certain multiarch environments. USN-2935-2 fixes the problem. Original issues from USN-2935-1: It...

USN-2949-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN-2949-1 Linux kernel Vivid HWE vulnerabilities Low/Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Venkatesh Pottem discovered a use-after-free vulnerability in the Linux kernel’s CXGB3 driver. A local attacker could use this to cause a denial of service...

USN-2957-1 Libtasn1 vulnerability | Cloud Foundry

USN-2957-1 Libtasn1 vulnerability Medium Vendor Canonical Ubuntu, Libtasn1 Versions Affected Ubuntu 14.04 LTS Description Pascal Cuoq and Miod Vallat discovered that Libtasn1 incorrectly handled certain malformed DER certificates. A remote attacker could possibly use this issue to cause...

USN-2959-1 OpenSSL vulnerabilities | Cloud Foundry

USN-2959-1 OpenSSL vulnerabilities High Vendor Canonical Ubuntu, OpenSSL Versions Affected Canonical Ubuntu 14.04 LTS, OpenSSLv1 Description Huzaifa Sidhpurwala, Hanno Böck, and David Benjamin discovered that OpenSSL incorrectly handled memory when decoding ASN.1 structures. A remote attacker cou...

CVE-2015-5170-5173 UAA Vulnerabilities | Cloud Foundry

CVE-2015-5170-5173 UAA Vulnerabilities Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions v215 & prior UAA versions 2.5.1 & prior Description CSRF Attack on PWS. It is possible to log the user into another account instead of the account they intended to log into because of...

Samba and Windows Vulnerabilities | Cloud Foundry

Samba and Windows Vulnerabilities Medium Vendor Samba, Microsoft Windows Versions Affected The following versions of Samba are affected: 3.6.x, 4.0.x, 4.1.x, 4.2.0-4.2.9, 4.3.0-4.3.6, and 4.4.0. The affected Microsoft Windows versions can be viewed here:...