rhsa-2008_0264
Vulnerability from csaf_redhat
Published
2008-05-20 14:15
Modified
2024-11-05 16:54
Summary
Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update

Notes

Topic
Red Hat Network Satellite Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server Solaris client components. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Details
This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server Solaris client. In a typical operating environment, these components are not used by the Satellite Server in a vulnerable manner. These security updates will reduce risk should these components be used by other applications. Two denial-of-service flaws were fixed in ZLib. (CVE-2005-2096, CVE-2005-1849) Multiple flaws were fixed in OpenSSL. (CVE-2006-4343, CVE-2006-4339, CVE-2006-3738, CVE-2006-2940, CVE-2006-2937, CVE-2005-2969) Multiple flaws were fixed in Python. (CVE-2007-4965, CVE-2007-2052, CVE-2006-4980, CVE-2006-1542) Users of Red Hat Network Satellite Server 5.0.1 are advised to upgrade to 5.0.2, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Network Satellite Server version 5.0.2 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server Solaris client components.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server Solaris\nclient. In a typical operating environment, these components are not used\nby the Satellite Server in a vulnerable manner. These security updates will\nreduce risk should these components be used by other applications.\n\nTwo denial-of-service flaws were fixed in ZLib. (CVE-2005-2096,\nCVE-2005-1849)\n\nMultiple flaws were fixed in OpenSSL. (CVE-2006-4343, CVE-2006-4339,\nCVE-2006-3738, CVE-2006-2940, CVE-2006-2937, CVE-2005-2969)\n\nMultiple flaws were fixed in Python. (CVE-2007-4965, CVE-2007-2052,\nCVE-2006-4980, CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server 5.0.1 are advised to upgrade to\n5.0.2, which resolves these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2008:0264",
        "url": "https://access.redhat.com/errata/RHSA-2008:0264"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "235093",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=235093"
      },
      {
        "category": "external",
        "summary": "295971",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=295971"
      },
      {
        "category": "external",
        "summary": "430640",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430640"
      },
      {
        "category": "external",
        "summary": "430641",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430641"
      },
      {
        "category": "external",
        "summary": "430649",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430649"
      },
      {
        "category": "external",
        "summary": "430651",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430651"
      },
      {
        "category": "external",
        "summary": "430652",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430652"
      },
      {
        "category": "external",
        "summary": "430654",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430654"
      },
      {
        "category": "external",
        "summary": "430655",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430655"
      },
      {
        "category": "external",
        "summary": "430659",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430659"
      },
      {
        "category": "external",
        "summary": "430660",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430660"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0264.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update",
    "tracking": {
      "current_release_date": "2024-11-05T16:54:11+00:00",
      "generator": {
        "date": "2024-11-05T16:54:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2008:0264",
      "initial_release_date": "2008-05-20T14:15:00+00:00",
      "revision_history": [
        {
          "date": "2008-05-20T14:15:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2008-05-20T10:16:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T16:54:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 5.0 (RHEL v.4 AS)",
                "product": {
                  "name": "Red Hat Satellite 5.0 (RHEL v.4 AS)",
                  "product_id": "4AS-RHNSAT5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:network_satellite:5.0:el4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhn-solaris-bootstrap-0:5.0.2-3.noarch",
                "product": {
                  "name": "rhn-solaris-bootstrap-0:5.0.2-3.noarch",
                  "product_id": "rhn-solaris-bootstrap-0:5.0.2-3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhn-solaris-bootstrap@5.0.2-3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch",
                "product": {
                  "name": "rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch",
                  "product_id": "rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhn_solaris_bootstrap_5_0_2_3@1-0?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhn-solaris-bootstrap-0:5.0.2-3.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch"
        },
        "product_reference": "rhn-solaris-bootstrap-0:5.0.2-3.noarch",
        "relates_to_product_reference": "4AS-RHNSAT5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch as a component of Red Hat Satellite 5.0 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        },
        "product_reference": "rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch",
        "relates_to_product_reference": "4AS-RHNSAT5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2005-1849",
      "discovery_date": "2006-07-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430649"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "zlib DoS",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-1849"
        },
        {
          "category": "external",
          "summary": "RHBZ#430649",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430649"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-1849",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-1849"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-1849",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-1849"
        }
      ],
      "release_date": "2005-08-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "zlib DoS"
    },
    {
      "cve": "CVE-2005-2096",
      "discovery_date": "2006-06-30T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430650"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "zlib DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-2096"
        },
        {
          "category": "external",
          "summary": "RHBZ#430650",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430650"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-2096",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-2096"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2096",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2096"
        }
      ],
      "release_date": "2005-07-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "zlib DoS"
    },
    {
      "cve": "CVE-2005-2969",
      "discovery_date": "2005-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430660"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl mitm downgrade attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-2969"
        },
        {
          "category": "external",
          "summary": "RHBZ#430660",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430660"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-2969",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-2969"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2969",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2969"
        }
      ],
      "release_date": "2005-10-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl mitm downgrade attack"
    },
    {
      "cve": "CVE-2006-1542",
      "discovery_date": "2006-03-30T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430640"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to cause a \"stack overflow,\" and possibly gain privileges, by running a script from a current working directory that has a long name, related to the realpath function.  NOTE: this might not be a vulnerability. However, the fact that it appears in a programming language interpreter could mean that some applications are affected, although attack scenarios might be limited because the attacker might already need to cross privilege boundaries to cause an exploitable program to be placed in a directory with a long name; or, depending on the method that Python uses to determine the current working directory, setuid applications might be affected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttps://access.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-1542"
        },
        {
          "category": "external",
          "summary": "RHBZ#430640",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430640"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-1542",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-1542"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-1542",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-1542"
        }
      ],
      "release_date": "2005-09-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "python buffer overflow"
    },
    {
      "cve": "CVE-2006-2937",
      "discovery_date": "2006-07-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430655"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl ASN.1 DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-2937"
        },
        {
          "category": "external",
          "summary": "RHBZ#430655",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430655"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-2937",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-2937"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-2937",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2937"
        }
      ],
      "release_date": "2006-09-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssl ASN.1 DoS"
    },
    {
      "cve": "CVE-2006-2940",
      "discovery_date": "2006-07-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430654"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) \"public exponent\" or (2) \"public modulus\" values in X.509 certificates that require extra time to process when using RSA signature verification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl public key DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-2940"
        },
        {
          "category": "external",
          "summary": "RHBZ#430654",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430654"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-2940",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-2940"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-2940",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2940"
        }
      ],
      "release_date": "2006-09-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl public key DoS"
    },
    {
      "cve": "CVE-2006-3738",
      "discovery_date": "2006-08-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430652"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl get_shared_ciphers overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-3738"
        },
        {
          "category": "external",
          "summary": "RHBZ#430652",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430652"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-3738",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-3738"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-3738",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-3738"
        }
      ],
      "release_date": "2006-09-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl get_shared_ciphers overflow"
    },
    {
      "cve": "CVE-2006-4339",
      "discovery_date": "2006-09-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430659"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl signature forgery",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-4339"
        },
        {
          "category": "external",
          "summary": "RHBZ#430659",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430659"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-4339",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-4339"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-4339",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4339"
        }
      ],
      "release_date": "2006-09-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl signature forgery"
    },
    {
      "cve": "CVE-2006-4343",
      "discovery_date": "2006-08-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430651"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl sslv2 client code",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-4343"
        },
        {
          "category": "external",
          "summary": "RHBZ#430651",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430651"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-4343",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-4343"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-4343",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4343"
        }
      ],
      "release_date": "2006-09-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssl sslv2 client code"
    },
    {
      "cve": "CVE-2006-4980",
      "discovery_date": "2006-09-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430641"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python repr unicode buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-4980"
        },
        {
          "category": "external",
          "summary": "RHBZ#430641",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430641"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-4980",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-4980"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-4980",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4980"
        }
      ],
      "release_date": "2006-08-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python repr unicode buffer overflow"
    },
    {
      "cve": "CVE-2007-2052",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2007-04-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "235093"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python off-by-one locale.strxfrm() (possible memory disclosure)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttps://access.redhat.com/security/updates/classification/",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-2052"
        },
        {
          "category": "external",
          "summary": "RHBZ#235093",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=235093"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-2052",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-2052"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-2052",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-2052"
        }
      ],
      "release_date": "2007-04-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "python off-by-one locale.strxfrm() (possible memory disclosure)"
    },
    {
      "cve": "CVE-2007-4965",
      "discovery_date": "2007-09-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "295971"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain sensitive information (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python imageop module heap corruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=295971\n\nThe Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: https://access.redhat.com/security/updates/classification/",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
          "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-4965"
        },
        {
          "category": "external",
          "summary": "RHBZ#295971",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=295971"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-4965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-4965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-4965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4965"
        }
      ],
      "release_date": "2007-09-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-05-20T14:15:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5:rhn-solaris-bootstrap-0:5.0.2-3.noarch",
            "4AS-RHNSAT5:rhn_solaris_bootstrap_5_0_2_3-0:1-0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0264"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python imageop module heap corruption"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.