Monthly Archives: November 2015

NVD

CVE-2015-8330

The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.

Ubuntu

USN-2816-1: Django vulnerability

Ubuntu Security Notice USN-2816-1

24th November, 2015

python-django vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.10
  • Ubuntu 15.04
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Django could be made to expose sensitive information over the network.

Software description

  • python-django
    – High-level Python web development framework

Details

Ryan Butterfield discovered that Django incorrectly handled the date
template filter. A remote attacker could possibly use this issue to obtain
secrets from application settings.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.10:
python3-django

1.7.9-1ubuntu5.1
python-django

1.7.9-1ubuntu5.1
Ubuntu 15.04:
python3-django

1.7.6-1ubuntu2.3
python-django

1.7.6-1ubuntu2.3
Ubuntu 14.04 LTS:
python-django

1.6.1-2ubuntu0.11
Ubuntu 12.04 LTS:
python-django

1.3.1-4ubuntu1.19

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-8213

Ubuntu

USN-2817-1: IcedTea Web vulnerabilities

Ubuntu Security Notice USN-2817-1

24th November, 2015

icedtea-web vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.10
  • Ubuntu 15.04
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in IcedTea Web.

Software description

  • icedtea-web
    – A web browser plugin to execute Java applets

Details

It was discovered that IcedTea Web incorrectly handled applet URLs. A
remote attacker could possibly use this issue to inject applets into the
.appletTrustSettings configuration file and bypass user approval.
(CVE-2015-5234)

Andrea Palazzo discovered that IcedTea Web incorrectly determined the
origin of unsigned applets. A remote attacker could possibly use this issue
to bypass user approval, or to trick the user into approving applet
execution. (CVE-2015-5235)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.10:
icedtea-7-plugin

1.5.3-0ubuntu0.15.10.1
Ubuntu 15.04:
icedtea-7-plugin

1.5.3-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
icedtea-7-plugin

1.5.3-0ubuntu0.14.04.1
icedtea-6-plugin

1.5.3-0ubuntu0.14.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart your browser to make
all the necessary changes.

References

CVE-2015-5234,

CVE-2015-5235

Security

Red Hat Security Advisory 2015-2514-01

Red Hat Security Advisory 2015-2514-01 – Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on JBoss Application Server. It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.