Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:27826
HistoryMar 20, 2012 - 12:00 a.m.

VMSA-20120005 VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, ESXi and ESX address several security issues

2012-03-2000:00:00
vulners.com
209
JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

              VMware Security Advisory

Advisory ID: VMSA-2012-0005
Synopsis: VMware vCenter Server, Orchestrator, Update Manager,
vShield, vSphere Client, ESXi and ESX address
several security issues
Issue date: 2012-03-15
Updated on: 2012-03-15 (initial advisory)

CVE numbers: CVE-2012-1508, CVE-2012-1509, CVE-2012-1510,
CVE-2012-1512, CVE-2012-1513, CVE-2012-1514,
CVE-2011-3190, CVE-2011-3375, CVE-2012-0022,
CVE-2010-0405
— JRE —
See references

  1. Summary

    VMware vCenter Server, Orchestrator, Update Manager, vShield,
    vSphere Client, ESXi and ESX address several security issues

  2. Relevant releases

    VMware vCenter Server 5.0

    VMware vSphere Client 5.0
    VMware vSphere Client 4.1 Update 1 and earlier

    VMware vCenter Orchestrator 4.2
    VMware vCenter Orchestrator 4.1 Update 1 and earlier
    VMware vCenter Orchestrator 4.0 Update 3 and earlier

    VMware vShield Manager 4.1 Update 1
    VMware vShield Manager 1.0 Update 1

    VMware Update Manager 5.0

    ESXi 5.0 without patches ESXi500-201203101-SG, ESXi500-201112402-BG
    ESXi 4.1 without patch ESXi410-201110202-UG
    ESXi 4.0 without patch ESXi400-201110402-BG

    ESX 4.1 without patch ESX410-201110201-SG
    ESX 4.0 without patch ESX400-201110401-SG

  3. Problem Description

    a. VMware Tools Display Driver Privilege Escalation

    The VMware XPDM and WDDM display drivers contain buffer overflow
    vulnerabilities and the XPDM display driver does not properly
    check for NULL pointers. Exploitation of these issues may lead
    to local privilege escalation on Windows-based Guest Operating
    Systems.

    VMware would like to thank Tarjei Mandt for reporting theses
    issues to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the names CVE-2012-1509 (XPDM buffer overrun),
    CVE-2012-1510 (WDDM buffer overrun) and CVE-2012-1508 (XPDM null
    pointer dereference) to these issues.

    Note: CVE-2012-1509 doesn't affect ESXi and ESX.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

     VMware         Product   Running  Replace with/
 Product *      Version   on       Apply Patch **
 =============  ========  =======  =================
 vCenter        any       Windows  not affected
 
 Workstation    8.x       any      not affected
 
 Player         4.x       any      not affected
 
 Fusion         4.x       Mac OS/X not affected
 
 ESXi           5.0       ESXi     ESXi500-201112402-BG
 ESXi           4.1       ESXi     ESXi410-201110202-UG
 ESXi           4.0       ESXi     ESXi400-201110402-BG
 ESXi           3.5       ESXi     not affected
 
 ESX            4.1       ESX      ESX410-201110201-SG
 ESX            4.0       ESX      ESX400-201110401-SG
 ESX            3.5       ESX      not affected

 * Remediation for VMware View is described in VMSA-2012-0004.

 ** Notes on updating VMware Guest Tools:

 After the update or patch is applied, VMware Guest Tools must
 be updated in any pre-existing Windows-based Guest Operating
 System. The XPDM and WDDM drivers are part of Tools.

 Windows-Based Virtual Machines that have moved to Workstation
 8 or Player 4 from a lower version of Workstation or Player
 are affected unless:

     - They were moved from Workstation 7.1.5 or Player 3.1.5,

          AND

     - The Tools version was updated before the move.

 Windows-Based Virtual Machines that have moved to Fusion 4
 from a lower version of Fusion are affected.

    b. vSphere Client internal browser input validation vulnerability

    The vSphere Client has an internal browser that renders html
    pages from log file entries. This browser doesn't properly
    sanitize input and may run script that is introduced into the
    log files. In order for the script to run, the user would need
    to open an individual, malicious log file entry. The script
    would run with the permissions of the user that runs the vSphere
    Client.

    VMware would like to thank Edward Torkington for reporting this
    issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2012-1512 to this issue.

    In order to remediate the issue, the vSphere Client of the
    vSphere 5.0 Update 1 release or the vSphere 4.1 Update 2 release
    needs to be installed. The vSphere Clients that come with
    vSphere 4.0 and vCenter Server 2.5 are not affected.

    c. vCenter Orchestrator Password Disclosure

    The vCenter Orchestrator (vCO) Web Configuration tool reflects
    back the vCenter Server password as part of the webpage. This
    might allow the logged-in vCO administrator to retrieve the
    vCenter Server password.

    VMware would like to thank Alexey Sintsov from Digital Security
    Research Group for reporting this issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2012-1513 to this issue.

     VMware         Product  Running    Replace with/
 Product        Version  on         Apply Patch
 =============  =======  =======    =================
 vCO            4.2      Windows    vCO 4.2 Update 1
 vCO            4.1      Windows    vCO 4.1 Update 2
 vCO            4.0      Windows    vCO 4.0 Update 4

    d. vShield Manager Cross-Site Request Forgery vulnerability

    The vShield Manager (vSM) interface has a Cross-Site Request
    Forgery vulnerability. If an attacker can convince an
    authenticated user to visit a malicious link, the attacker may
    force the victim to forward an authenticated request to the
    server.

    VMware would like to thank Frans Pehrson of Xxor AB
    (www.xxor.se) and Claudio Criscione for independently reporting
    this issue to us

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2012-1514 to this issue.

     VMware         Product  Running    Replace with/
 Product        Version  on         Apply Patch
 =============  =======  =======    =================
 vSM            5.0      Linux      not affected
 vSM            4.1      Linux      vSM 4.1.0 Update 2
 vSM            4.0      Linux      vSM 1.0.1 Update 2

    e. vCenter Update Manager, Oracle (Sun) JRE update 1.6.0_30

    Oracle (Sun) JRE is updated to version 1.6.0_30, which addresses
    multiple security issues that existed in earlier releases of
    Oracle (Sun) JRE.

    Oracle has documented the CVE identifiers that are addressed in
    JRE 1.6.0_29 and JRE 1.6.0_30 in the Oracle Java SE Critical
    Patch Update Advisory of October 2011. The References section
    provides a link to this advisory.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

     VMware         Product  Running     Replace with/
 Product        Version  on          Apply Patch
 =============  =======  =======     =================
 vCenter        5.       Windows     patch pending
 vCenter        4.1      Windows     patch pending
 vCenter        4.0      Windows     not applicable **
 VirtualCenter  2.5      Windows     not applicable **

 Update Manager 5.0      Windows     Update Manager 5.0 Update 1
 Update Manager 4.1      Windows     not applicable **
 Update Manager 4.0      Windows     not applicable **

 hosted *       any      any         not affected

 ESXi           any      ESXi        not applicable

 ESX            4.1      ESX         patch pending
 ESX            4.0      ESX         not applicable **
 ESX            3.5      ESX         not applicable **

 * hosted products are VMware Workstation, Player, ACE, Fusion.

 ** this product uses the Oracle (Sun) JRE 1.5.0 family

    f. vCenter Server Apache Tomcat update 6.0.35

    Apache Tomcat has been updated to version 6.0.35 to address
    multiple security issues.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the names CVE-2011-3190, CVE-2011-3375, and
    CVE-2012-0022 to these issues.

     VMware         Product  Running     Replace with/
 Product        Version  on          Apply Patch
 =============  =======  =======     =================
 vCenter        5.0      Windows     vCenter 5.0 Update 1
 vCenter        4.1      Windows     patch pending
 vCenter        4.0      Windows     patch pending
 VirtualCenter  2.5      Windows     not applicable **
 
 hosted *       any      any         not affected
 
 ESXi           any      ESXi        not applicable
 
 ESX            4.1      ESX         patch pending
 ESX            4.0      ESX         patch pending
 ESX            3.5      ESX         not applicable **

 * hosted products are VMware Workstation, Player, ACE, Fusion.

 ** this product uses the Apache Tomcat 5.5 family

    g. ESXi update to third party component bzip2

    The bzip2 library is updated to version 1.0.6, which resolves a
    security issue.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2010-0405 to this issue.

     VMware         Product  Running     Replace with/
 Product        Version  on          Apply Patch
 =============  =======  =======    =================
 vCenter        any      Windows    not affected
 
 hosted *       any      any        not affected
 
 ESXi           5.0      ESXi       ESXi500-201203101-SG
 ESXi           4.1      ESXi       not affected
 ESXi           4.0      ESXi       not affected
 ESXi           3.5      ESXi       not affected
 
 ESX            any      ESX        not applicable

 * hosted products are VMware Workstation, Player, ACE, Fusion.

  4. Solution

    Please review the patch/release notes for your product and version
    and verify the checksum of your downloaded file.

    vCenter Server 5.0 Update 1

    The download for vCenter Server includes vSphere Update Manager,
    vSphere Client, and vCenter Orchestrator

    Download link:

http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_v
sphere/5_0

Release Notes:
vSphere vCenter Server

https://www.vmware.com/support/pubs/vsphere-esxi-vcenter-server-pubs.html
https://www.vmware.com/support/pubs/vum_pubs.html

File: VMware-VIMSetup-all-5.0.0-639890.iso
md5sum:f860ac4b618e2562ebffa2318446fa5b
sha1sum:62830e3061b983e98944ae6d9d3b2e820cebe270

File: VMware-VIMSetup-all-5.0.0-639890.zip
md5sum:a8bdde277aeeffc382ec210acf510479
sha1sum:0b675a47349fdc09104c62ad84bd302846213fc8

vCenter Server 4.1 Update 2

The download for vCenter Server includes vSphere Client and
vCenter Orchestrator.

Download link:

http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_v
sphere/4_1

Release Notes:

http://downloads.vmware.com/support/pubs/vs_pages/vsp_pubs_esx41_vc41.html

File: VMware-VIMSetup-all-4.1.0-493063.iso
md5sum: d132326846a85bfc9ebbc53defeee6e1
sha1sum: 192c3e5d2a10bbe53c025cc7eedb3133a23e0541

File: VMware-VIMSetup-all-4.1.0-493063.zip
md5sum: 7fd7b09e501bd8fde52649b395491222
sha1sum: 46dd00e7c594ac672a5d7c3c27d15be2f5a5f1f1

vCenter Server 4.0 Update 4

The download for vCenter Server includes vCenter Orchestrator.

Download link:

http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_v
sphere/4_0

Release Notes:

http://downloads.vmware.com/support/pubs/vs_pages/vsp_pubs_esx40_vc40.html

File: VMware-VIMSetup-all-4.0.0-502539.iso
md5sum: b418ff3d394f91b418271b6b93dfd6bd
sha1sum: 56c2ec60f8b8a734a8312d9e38d5d70cd20c0927

File: VMware-VIMSetup-all-4.0.0-502539.zip
md5sum: 2acfadde1ec0cd6d37063d87246d6942
sha1sum: ea1f3a3cb178f23fc2cf49bfc1450d10e5f699f8

vShield Manager 4.1.0 Update 2

Download link:

http://downloads.vmware.com/d/details/vshield_endpoint10u3/ZHB3YnRAKndidHR3
ag==

Release Notes:

https://www.vmware.com/support/vshield/doc/releasenotes_vshield_410U2.html

File: VMware-vShield-Manager-upgrade-bundle-4.1.0U2-576124.tar.gz
md5sum:9a80fc347bc4a19ad0fd4c9fcb4ab475
sha1sum:f5780c1615da0493d0955a1343876c4111d85203

vShield Zones 1.0 Update 2

The download for VMware vShield Zones contains vShield Manager

Download link:
http://downloads.vmware.com/d/details/zones10u2/dHRAYndld2pidHclJQ==

Release Notes
https://www.vmware.com/support/vsz/doc/releasenotes_vsz_10U2.html

File: VMware-vShieldZones-1.0U2-638154.exe
md5sum:73515f4732c3a1ecc91ef21a504ca6d9
sha1sum:ed4d858e1c05f54679ba99b739270c054efaf63e

ESXi and ESX

Download link:
http://downloads.vmware.com/go/selfsupport-download

ESXi 5.0

File: update-from-esxi5.0-5.0_update01
md5sum: 55c25bd990e2881462bc5b66fb5f6c39
sha1sum: ecd871bb09b649c6c8c13de82d579d4b7dcadc88
http://kb.vmware.com/kb/2011432
update-from-esxi5.0-5.0_update01 contains ESXi500-201203101-SG

File: ESXi500-201112001
md5sum: 107ec1cf6ee1d5d5cb8ea5c05b05cc10
sha1sum: aff63c8a170508c8c0f21a60d1ea75ef1922096d
http://kb.vmware.com/kb/2007672
ESXi500-201112001 contains ESXi500-201112402-BG

Note: subsequent ESXi releases are cumulative and
ESXi500-201203101-SG includes the security fixes that are
present in ESXi500-201112402-BG

ESXi 4.1

File: update-from-esxi4.1-4.1_update02
md5sum: 57e34b500ce543d778f230da1d44e412
sha1sum: 52f4378e2f1a29c908493182ccbde91d58b4112f
http://kb.vmware.com/kb/2002341
update-from-esxi4.1-4.1_update02 contains ESXi410-201110202-UG

ESXi 4.0

File: ESXi400-201110001
md5sum: fd47b5e2b7ea1db79a2e0793d4c9d9d3
sha1sum: 759d4fa6da6eb49f41def68e3bd66e80c9a7032b
http://kb.vmware.com/kb/1039199
ESXi400-201110001 contains ESXi400-201110402-BG

ESX 4.1

File: update-from-esx4.1-4.1_update02
md5sum: 96189a6de3797e28b153f89e01d5a15b
sha1sum: b1823d39d0e4536a421fb933f02380bae7ee7a5d
http://kb.vmware.com/kb/2002303
update-from-esx4.1-4.1_update02 contains ESX410-201110201-SG

ESX 4.0

File: ESX400-201110001
md5sum: 0ce9cc285ea5c27142c9fdf273443d78
sha1sum: fdb5482b2bf1e9c97f2814255676e3de74512399
http://kb.vmware.com/kb/1036392
ESX400-201110001 contains ESX400-201110401-SG

  1. References

    Oracle Java SE Critical Patch Update Advisory of October 2011

http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htm
l

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1508
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1509
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1512
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1513
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1514
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0022
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0405

  1. Change log

    2012-03-15 VMSA-2012-0005

    Initial security advisory in conjunction with the release of
    vSphere 5.0 Update 1, Orchestrator 4.2 Update 1, Update Manager 5.0
    Update 1, vShield 1.0 Update 2, and ESXi and ESX 5.0 patches on
    2012-03-15.

  1. Contact

    E-mail list for product security notifications and announcements:
    http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

    This Security Advisory is posted to the following lists:

    E-mail: security at vmware.com
    PGP key at: http://kb.vmware.com/kb/1055

    VMware Security Advisories
    http://www.vmware.com/security/advisories

    VMware security response policy
    http://www.vmware.com/support/policies/security_response.html

    General support life cycle policy
    http://www.vmware.com/support/policies/eos.html

    VMware Infrastructure support life cycle policy
    http://www.vmware.com/support/policies/eos_vi.html

    Copyright 2012 VMware Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8

wj8DBQFPY8IgDEcm8Vbi9kMRArL4AJ9S8Fmumd26d3UyRUjpwue4WBIIAwCfX5lO
CZfePTwZlp9o+Bcf2/30Bjg=
=g0FE
-----END PGP SIGNATURE-----

Related

openvas 54
vmware 3
securityvulns 9
nessus 61
tomcat 5
ubuntu 4
cve 9
github 2
prion 9
fedora 6
freebsd 2
debiancve 3
ubuntucve 5
osv 4
oraclelinux 2
redhat 5
f5 2
freebsd_advisory 1
seebug 3
veracode 1
centos 1
slackware 1
ibm 2
altlinux 1
debian 3
gentoo 1
openvas
openvas
VMSA-2012-0005 VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, ESXi and ESX address several security issues
2012-03-16 00:00:00
VMware ESXi/ESX patches address several security issues (VMSA-2012-0005)
2012-03-16 00:00:00
Apache Tomcat 6.0.x < 6.0.35 Multiple Vulnerabilities - Linux
2021-10-29 00:00:00
vmware
vmware
VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, ESXi and ESX address several security issues
2012-03-15 00:00:00
VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, Workstation, Player, ESXi and ESX address several security issues
2012-03-15 00:00:00
VMware View privilege escalation and cross-site scripting
2012-03-15 00:00:00
securityvulns
securityvulns
VMWare applications multiple security vulnerabilities
2012-03-20 00:00:00
VMWare View multiple security vulnerabilities
2012-03-18 00:00:00
VMSA-2012-0004 VMware View privilege escalation and cross-site scripting
2012-03-18 00:00:00
nessus
nessus
VMSA-2012-0005 : VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, Workstation, Player, ESXi, and ESX address several security issues
2012-03-16 00:00:00
VMware vCenter Server Multiple Vulnerabilities (VMSA-2012-0005)
2013-06-05 00:00:00
Apache Tomcat 6.0.x < 6.0.35 Multiple Vulnerabilities
2012-02-22 00:00:00
tomcat
tomcat
Fixed in Apache Tomcat 6.0.35
2011-12-05 00:00:00
Fixed in Apache Tomcat 7.0.21
2011-09-01 00:00:00
Fixed in Apache Tomcat 7.0.23
2011-11-25 00:00:00
ubuntu
ubuntu
Tomcat vulnerabilities
2012-02-13 00:00:00
dpkg vulnerability
2010-09-20 00:00:00
ClamAV vulnerability
2010-09-20 00:00:00
cve
cve
CVE-2011-3190
2011-08-31 23:55:00
CVE-2012-1508
2012-03-16 20:55:00
CVE-2012-1514
2012-03-16 20:55:00
github
github
Apache Tomcat Allows Remote Attackers to Spoof AJP Requests
2022-05-14 01:17:02
Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests
2022-05-17 05:33:28
prion
prion
Cross site scripting
2012-03-16 20:55:00
Buffer overflow
2012-03-16 20:55:00
Authentication flaw
2011-08-31 23:55:00
fedora
fedora
[SECURITY] Fedora 12 Update: bzip2-1.0.6-1.fc12
2010-11-23 21:53:55
[SECURITY] Fedora 13 Update: clamav-0.96.4-1300.fc13
2010-11-22 22:15:40
[SECURITY] Fedora 14 Update: bzip2-1.0.6-1.fc14
2010-09-25 05:35:13
freebsd
freebsd
bzip2 -- integer overflow vulnerability
2010-09-21 00:00:00
tomcat -- Denial of Service
2011-10-21 00:00:00
debiancve
debiancve
CVE-2010-0405
2010-09-28 18:00:00
CVE-2011-3190
2011-08-31 23:55:00
CVE-2011-3375
2012-01-19 04:01:00
ubuntucve
ubuntucve
CVE-2012-1510
2012-03-16 00:00:00
CVE-2012-1509
2012-03-16 00:00:00
CVE-2011-3190
2011-08-31 00:00:00
osv
osv
bzip2 - integer overflow
2010-09-20 00:00:00
Apache Tomcat Allows Remote Attackers to Spoof AJP Requests
2022-05-14 01:17:02
Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests
2022-05-17 05:33:28
oraclelinux
oraclelinux
bzip2 security update
2010-09-20 00:00:00
bzip2 security update
2011-02-10 00:00:00
redhat
redhat
(RHSA-2010:0858) Important: bzip2 security update
2010-11-10 00:00:00
(RHSA-2010:0703) Important: bzip2 security update
2010-09-20 00:00:00
(RHSA-2012:1331) Moderate: JBoss Operations Network 3.1.1 update
2012-10-03 15:08:03
f5
f5
K15878 : bzip2 vulnerability CVE-2010-0405
2014-11-27 00:00:00
SOL15878 - bzip2 vulnerability CVE-2010-0405
2014-11-26 00:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-10:08.bzip2
2010-09-20 00:00:00
seebug
seebug
Apache Tomcat请求对象安全限制绕过漏洞
2012-02-04 00:00:00
Apache Tomcat Request Information Disclosure
2012-01-18 00:00:00
Apache Tomcat Large Number Denial Of Service
2012-01-18 00:00:00
veracode
veracode
Arbitrary Code Execution
2020-04-10 00:48:32
centos
centos
bzip2 security update
2010-09-21 09:46:58
slackware
slackware
[slackware-security] bzip2
2010-09-20 21:32:17
ibm
ibm
Security Bulletin: Vulnerability in bzip2 and libbzip2 before affects IBM License Metric Tool and IBM BigFix Inventory (CVE-2010-0405)
2022-08-19 23:26:06
Security Bulletin: Storwize V7000 Unified V1.3.2.3 and V1.4.0.0 Include Fixes for Multiple Vendor Security Vulnerabilities
2022-09-26 04:23:14
altlinux
altlinux
Security fix for the ALT Linux 5 package bzip2 version 1:1.0.6-alt1
2010-09-20 00:00:00
debian
debian
[SECURITY] [DSA-2112-1] New bzip2 packages fix integer overflow
2010-09-20 11:05:59
[SECURITY] [DSA-2112-1] New bzip2 packages fix integer overflow
2010-09-20 11:05:59
[SECURITY] [DSA 2401-1] tomcat6 security update
2012-02-02 19:29:50
gentoo
gentoo
bzip2: User-assisted execution of arbitrary code
2013-01-09 00:00:00
JSON
Related for SECURITYVULNS:DOC:27826
openvas54vmware3securityvulns9nessus61tomcat5ubuntu4cve9github2prion9fedora6freebsd2debiancve3ubuntucve5osv4oraclelinux2redhat5f52freebsd_advisory1seebug3veracode1centos1slackware1ibm2altlinux1debian3gentoo1