var-201601-0495
Vulnerability from variot
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126. libpng of png_set_PLTE The function contains a buffer overflow vulnerability. The following versions are affected: libpng prior to 1.0.65, 1.1.x and 1.2.x prior to 1.2.55, 1.3.x, 1.4.x prior to 1.4.18, 1.5.x prior to 1.5.25, 1.6 1.6.x versions prior to .20. 5) - i386, ppc, s390x, x86_64
- Description:
IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494)
Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file. All running instances of IBM Java must be restarted for the update to take effect. Bugs fixed (https://bugzilla.redhat.com/):
1276416 - CVE-2015-7981 libpng: Out-of-bounds read in png_convert_to_rfc1123 1281756 - CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions 1289841 - CVE-2015-7575 TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) 1291312 - CVE-2015-8540 libpng: underflow read in png_check_keyword() 1298906 - CVE-2016-0494 ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) 1298957 - CVE-2016-0402 OpenJDK: URL deserialization inconsistencies (Networking, 8059054) 1299073 - CVE-2016-0448 OpenJDK: logging of RMI connection secrets (JMX, 8130710) 1299385 - CVE-2016-0466 OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) 1299441 - CVE-2016-0483 OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) 1302689 - CVE-2015-5041 IBM JDK: J9 JVM allows code to invoke non-public interface methods
- ============================================================================ Ubuntu Security Notice USN-2861-1 January 06, 2016
libpng vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.10
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
libpng could be made to crash or run programs as your login if it opened a specially crafted file. (CVE-2015-8472)
Qixue Xiao and Chen Yu discovered that libpng incorrectly handled certain malformed images. (CVE-2015-8540)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 15.10: libpng12-0 1.2.51-0ubuntu3.15.10.2
Ubuntu 15.04: libpng12-0 1.2.51-0ubuntu3.15.04.2
Ubuntu 14.04 LTS: libpng12-0 1.2.50-1ubuntu2.14.04.2
Ubuntu 12.04 LTS: libpng12-0 1.2.46-3ubuntu4.2
After a standard system update you need to restart your session to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: libpng12 security update Advisory ID: RHSA-2015:2595-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2595.html Issue date: 2015-12-09 CVE Names: CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 =====================================================================
- Summary:
Updated libpng12 packages that fix three security issues are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
- Description:
The libpng12 packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.
It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image. (CVE-2015-7981)
All libpng12 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
- Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: libpng12-1.2.50-7.el7_2.src.rpm
x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: libpng12-1.2.50-7.el7_2.src.rpm
x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: libpng12-1.2.50-7.el7_2.src.rpm
aarch64: libpng12-1.2.50-7.el7_2.aarch64.rpm libpng12-debuginfo-1.2.50-7.el7_2.aarch64.rpm
ppc64: libpng12-1.2.50-7.el7_2.ppc.rpm libpng12-1.2.50-7.el7_2.ppc64.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc64.rpm
ppc64le: libpng12-1.2.50-7.el7_2.ppc64le.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc64le.rpm
s390x: libpng12-1.2.50-7.el7_2.s390.rpm libpng12-1.2.50-7.el7_2.s390x.rpm libpng12-debuginfo-1.2.50-7.el7_2.s390.rpm libpng12-debuginfo-1.2.50-7.el7_2.s390x.rpm
x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
aarch64: libpng12-debuginfo-1.2.50-7.el7_2.aarch64.rpm libpng12-devel-1.2.50-7.el7_2.aarch64.rpm
ppc64: libpng12-debuginfo-1.2.50-7.el7_2.ppc.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc64.rpm libpng12-devel-1.2.50-7.el7_2.ppc.rpm libpng12-devel-1.2.50-7.el7_2.ppc64.rpm
ppc64le: libpng12-debuginfo-1.2.50-7.el7_2.ppc64le.rpm libpng12-devel-1.2.50-7.el7_2.ppc64le.rpm
s390x: libpng12-debuginfo-1.2.50-7.el7_2.s390.rpm libpng12-debuginfo-1.2.50-7.el7_2.s390x.rpm libpng12-devel-1.2.50-7.el7_2.s390.rpm libpng12-devel-1.2.50-7.el7_2.s390x.rpm
x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: libpng12-1.2.50-7.el7_2.src.rpm
x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2015-7981 https://access.redhat.com/security/cve/CVE-2015-8126 https://access.redhat.com/security/cve/CVE-2015-8472 https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iD4DBQFWaEOWXlSAg2UNWIIRArqQAJiXHpRTjePlByUwb2yeLtnA6ZHDAJ483rVP N/LWwsGEwId3XWZYVPOUSQ== =s2GT -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . (CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806, CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860, CVE-2015-4871, CVE-2015-4872, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4902, CVE-2015-4903, CVE-2015-5006, CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449)
Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the CVE-2015-4806 issue. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002
OS X El Capitan 10.11.4 and Security Update 2016-002 is now available and addresses the following:
apache_mod_php Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš
AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1733 : Proteas of Qihoo 360 Nirvan Team
AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1732 : Proteas of Qihoo 360 Nirvan Team
AppleUSBNetworking Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the parsing of data from USB devices. This issue was addressed through improved input validation. CVE-ID CVE-2016-1734 : Andrea Barisani and Andrej Rosano of Inverse Path
Bluetooth Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1735 : Jeonghoon Shin@A.D.D CVE-2016-1736 : beist and ABH of BoB
Carbon Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .dfont file may lead to arbitrary code execution Description: Multiple memory corruption issues existed in the handling of font files. These issues were addressed through improved bounds checking. CVE-ID CVE-2016-1737 : an anonymous researcher
dyld Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker may tamper with code-signed applications to execute arbitrary code in the application's context Description: A code signing verification issue existed in dyld. This issue was addressed with improved validation. CVE-ID CVE-2016-1738 : beist and ABH of BoB
FontParser Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1740 : HappilyCoded (ant4g0nist and r3dsm0k3) working with Trend Micro's Zero Day Initiative (ZDI)
HTTPProtocol Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to execute arbitrary code Description: Multiple vulnerabilities existed in nghttp2 versions prior to 1.6.0, the most serious of which may have led to remote code execution. These were addressed by updating nghttp2 to version 1.6.0. CVE-ID CVE-2015-8659
Intel Graphics Driver Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1743 : Piotr Bania of Cisco Talos CVE-2016-1744 : Ian Beer of Google Project Zero
IOFireWireFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to cause a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1745 : sweetchip of Grayhash
IOGraphics Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1746 : Peter Pi of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1747 : Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI)
IOHIDFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1748 : Brandon Azad
IOUSBFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1749 : Ian Beer of Google Project Zero and Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI)
Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-ID CVE-2016-1750 : CESG
Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition existed during the creation of new processes. This was addressed through improved state handling. CVE-ID CVE-2016-1757 : Ian Beer of Google Project Zero and Pedro Vilaca
Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved input validation. CVE-ID CVE-2016-1756 : Lufeng Li of Qihoo 360 Vulcan Team
Kernel Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1754 : Lufeng Li of Qihoo 360 Vulcan Team CVE-2016-1755 : Ian Beer of Google Project Zero CVE-2016-1759 : lokihardt
Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1758 : Brandon Azad
Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple integer overflows were addressed through improved input validation. CVE-ID CVE-2016-1753 : Juwei Lin Trend Micro working with Trend Micro's Zero Day Initiative (ZDI)
Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to cause a denial of service Description: A denial of service issue was addressed through improved validation. CVE-ID CVE-2016-1752 : CESG
libxml2 Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing maliciously crafted XML may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2015-1819 CVE-2015-5312 : David Drysdale of Google CVE-2015-7499 CVE-2015-7500 : Kostya Serebryany of Google CVE-2015-7942 : Kostya Serebryany of Google CVE-2015-8035 : gustavo.grieco CVE-2015-8242 : Hugh Davenport CVE-2016-1761 : wol0xff working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1762
Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker who is able to bypass Apple's certificate pinning, intercept TLS connections, inject messages, and record encrypted attachment-type messages may be able to read attachments Description: A cryptographic issue was addressed by rejecting duplicate messages on the client. CVE-ID CVE-2016-1788 : Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan of Johns Hopkins University
Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a JavaScript link can reveal sensitive user information Description: An issue existed in the processing of JavaScript links. This issue was addressed through improved content security policy checks. CVE-ID CVE-2016-1764 : Matthew Bryan of the Uber Security Team (formerly of Bishop Fox), Joe DeMesy and Shubham Shah of Bishop Fox
NVIDIA Graphics Drivers Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1741 : Ian Beer of Google Project Zero
OpenSSH Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Connecting to a server may leak sensitive user information, such as a client's private keys Description: Roaming, which was on by default in the OpenSSH client, exposed an information leak and a buffer overflow. These issues were addressed by disabling roaming in the client. CVE-ID CVE-2016-0777 : Qualys CVE-2016-0778 : Qualys
OpenSSH Available for: OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5 Impact: Multiple vulnerabilities in LibreSSL Description: Multiple vulnerabilities existed in LibreSSL versions prior to 2.1.8. These were addressed by updating LibreSSL to version 2.1.8. CVE-ID CVE-2015-5333 : Qualys CVE-2015-5334 : Qualys
OpenSSL Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to cause a denial of service Description: A memory leak existed in OpenSSL versions prior to 0.9.8zh. This issue was addressed by updating OpenSSL to version 0.9.8zh. CVE-ID CVE-2015-3195
Python Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2014-9495 CVE-2015-0973 CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš
QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted FlashPix Bitmap Image may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1767 : Francis Provencher from COSIG CVE-2016-1768 : Francis Provencher from COSIG
QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted Photoshop document may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1769 : Francis Provencher from COSIG
Reminders Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a tel link can make a call without prompting the user Description: A user was not prompted before invoking a call. This was addressed through improved entitlement checks. CVE-ID CVE-2016-1770 : Guillaume Ross of Rapid7 and Laurent Chouinard of Laurent.ca
Ruby Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution Description: An unsafe tainted string usage vulnerability existed in versions prior to 2.0.0-p648. This issue was addressed by updating to version 2.0.0-p648. CVE-ID CVE-2015-7551
Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to check for the existence of arbitrary files Description: A permissions issue existed in code signing tools. This was addressed though additional ownership checks. CVE-ID CVE-2016-1773 : Mark Mentovai of Google Inc.
Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted certificate may lead to arbitrary code execution Description: A memory corruption issue existed in the ASN.1 decoder. This issue was addressed through improved input validation. CVE-ID CVE-2016-1950 : Francis Gabriel of Quarkslab
Tcl
Available for:
OS X Yosemite v10.10.5 and OS X El Capitan v10.11 to v10.11.3
Impact: Processing a maliciously crafted .png file may lead to
arbitrary code execution
Description: Multiple vulnerabilities existed in libpng versions
prior to 1.6.20. These were addressed by removing libpng.
CVE-ID
CVE-2015-8126 : Adam Mariš
TrueTypeScaler Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2016-1775 : 0x1byte working with Trend Micro's Zero Day Initiative (ZDI)
Wi-Fi Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker with a privileged network position may be able to execute arbitrary code Description: A frame validation and memory corruption issue existed for a given ethertype. This issue was addressed through additional ethertype validation and improved memory handling. CVE-ID CVE-2016-0801 : an anonymous researcher CVE-2016-0802 : an anonymous researcher
OS X El Capitan 10.11.4 includes the security content of Safari 9.1. https://support.apple.com/kb/HT206171
OS X El Capitan v10.11.4 and Security Update 2016-002 may be obtained from the Mac App Store or Apple's Software Downloads web site: http://www.apple.com/support/downloads/
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJW8JQFAAoJEBcWfLTuOo7tZSYP/1bHFA1qemkD37uu7nYpk/q6 ARVsPgME1I1+5tOxX0TQJgzMBmdQsKYdsTiLpDk5HTuv+dAMsFfasaUItGk8Sz1w HiYjSfVsxL+Pjz3vK8/4/fsi2lX6472MElRw8gudITOhXtniGcKo/vuA5dB+vM3l Jy1NLHHhZ6BD2t0bBmlz41mZMG3AMxal2wfqE+5LkjUwASzcvC/3B1sh7Fntwyau /71vIgMQ5AaETdgQJAuQivxPyTlFduBRgLjqvPiB9eSK4Ctu5t/hErFIrP2NiDCi UhfZC48XbiRjJfkUsUD/5TIKnI+jkZxOnch9ny32dw2kUIkbIAbqufTkzsMXOpng O+rI93Ni7nfzgI3EkI2bq+C+arOoRiveWuJvc3SMPD5RQHo4NCQVs0ekQJKNHF78 juPnY29n8WMjwLS6Zfm+bH+n8ELIXrmmEscRztK2efa9S7vJe+AgIxx7JE/f8OHF i9K7UQBXFXcpMjXi1aTby/IUnpL5Ny4NVwYwIhctj0Mf6wTH7uf/FMWYIQOXcIfP Izo+GXxNeLd4H2ypZ+UpkZg/Sn2mtCd88wLc96+owlZPBlSqWl3X1wTlp8i5FP2X qlQ7RcTHJDv8jPT/MOfzxEK1n/azp45ahHA0o6nohUdxlA7PLci9vPiJxqKPo/0q VZmOKa8qMxB1L/JmdCqy =mZR+ -----END PGP SIGNATURE----- .
Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/libpng-1.4.18-x86_64-1_slack14.1.txz: Upgraded. Fixed incorrect implementation of png_set_PLTE() that uses png_ptr not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126 vulnerability. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472 ( Security fix ) +--------------------------+
Where to find the new packages: +-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.
Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/libpng-1.2.55-i486-1_slack13.0.txz
Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/libpng-1.2.55-x86_64-1_slack13.0.txz
Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/libpng-1.4.18-i486-1_slack13.1.txz
Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/libpng-1.4.18-x86_64-1_slack13.1.txz
Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/libpng-1.4.18-i486-1_slack13.37.txz
Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/libpng-1.4.18-x86_64-1_slack13.37.txz
Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/libpng-1.4.18-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/libpng-1.4.18-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libpng-1.4.18-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libpng-1.4.18-x86_64-1_slack14.1.txz
Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libpng-1.6.20-i586-1.txz
Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/libpng-1.6.20-x86_64-1.txz
MD5 signatures: +-------------+
Slackware 13.0 package: 0ee9224ad5684fad22c1b0c90605c63b libpng-1.2.55-i486-1_slack13.0.txz
Slackware x86_64 13.0 package: d9b29264e8312baf0c511c81ad779e59 libpng-1.2.55-x86_64-1_slack13.0.txz
Slackware 13.1 package: 28f6f162e3808d1dcdf6a3a98a8ccd69 libpng-1.4.18-i486-1_slack13.1.txz
Slackware x86_64 13.1 package: 156846c2db1a60cc840ed6e545ad9ec3 libpng-1.4.18-x86_64-1_slack13.1.txz
Slackware 13.37 package: 6c2eb1e0434a742f837b3d136d09fa89 libpng-1.4.18-i486-1_slack13.37.txz
Slackware x86_64 13.37 package: 099974c30fce3f57ba60249e6cd4ad99 libpng-1.4.18-x86_64-1_slack13.37.txz
Slackware 14.0 package: b546c957f439e78bbee7bdd429953a76 libpng-1.4.18-i486-1_slack14.0.txz
Slackware x86_64 14.0 package: 66903cc8d9eea2c47698ff0776da13e2 libpng-1.4.18-x86_64-1_slack14.0.txz
Slackware 14.1 package: f2dfcb4aa0a05fccf81f60f913bc7e8e libpng-1.4.18-i486-1_slack14.1.txz
Slackware x86_64 14.1 package: c06efdbec225394a156860a4f571dd59 libpng-1.4.18-x86_64-1_slack14.1.txz
Slackware -current package: 6f2e6e7f5f8c3760a372cc9ae3130060 l/libpng-1.6.20-i586-1.txz
Slackware x86_64 -current package: 8be8af75ec81e9463adf345c0bf48432 l/libpng-1.6.20-x86_64-1.txz
Installation instructions: +------------------------+
Upgrade the package as root:
upgradepkg libpng-1.4.18-i486-1_slack14.1.txz
+-----+
Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com
+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201601-0495",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.4.15"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.5.4"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.4.16"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.5.5"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.4.17"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.4.14"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.5.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.5.6"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.5.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.6,
"vendor": "libpng",
"version": "1.5.3"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.22"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.12"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.44"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.19"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.13"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.15"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.8"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.54"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.11"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.3"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.4"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.4"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.18"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.53"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.17"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.4"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.15"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.13"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.34"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.5"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.14"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.29"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.37"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.30"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.31"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.47"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.8"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.49"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.14"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.36"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.12"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.10"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.15"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.19"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.9"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.10"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.11"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.20"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.41"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.10"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.12"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.50"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.45"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.17"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.22"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.16"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.16"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.5"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.46"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.8"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.38"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.7"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.21"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.1"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.21"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.26"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.24"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.17"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.23"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.6"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.16"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.18"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.13"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.51"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.19"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.25"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.28"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.48"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.3"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.20"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.9"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.23"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.43"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.11"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.11"
},
{
"model": "mac os x",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "10.11.3"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.7"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.24"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.0.64"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.12"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.3"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.10"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.2"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.32"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.14"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.7"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.33"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.13"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.5.18"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.9"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.35"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.52"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.40"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.6.0"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.27"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.4.6"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.39"
},
{
"model": "libpng",
"scope": "eq",
"trust": 1.0,
"vendor": "libpng",
"version": "1.2.42"
},
{
"model": "libpng",
"scope": "lt",
"trust": 0.8,
"vendor": "png group",
"version": "1.6.x"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.9.5"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.11 to 10.11.3"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.8,
"vendor": "png group",
"version": "1.1.x"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.8,
"vendor": "png group",
"version": "1.5.25"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.8,
"vendor": "png group",
"version": "1.2.55"
},
{
"model": "jdk",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "7 update 91"
},
{
"model": "jdk",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "6 update 105"
},
{
"model": "jre",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "7 update 91"
},
{
"model": "jre",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "6 update 105"
},
{
"model": "libpng",
"scope": "lt",
"trust": 0.8,
"vendor": "png group",
"version": "1.5.x"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.10.5"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.8,
"vendor": "png group",
"version": "1.4.18"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.8,
"vendor": "png group",
"version": "1.6.20"
},
{
"model": "java se",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "embedded 8 update 65"
},
{
"model": "jdk",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "8 update 66"
},
{
"model": "jre",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "8 update 66"
},
{
"model": "libpng",
"scope": "lt",
"trust": 0.8,
"vendor": "png group",
"version": "1.4.x"
},
{
"model": "libpng",
"scope": "lt",
"trust": 0.8,
"vendor": "png group",
"version": "1.2.x"
},
{
"model": "libpng",
"scope": "eq",
"trust": 0.8,
"vendor": "png group",
"version": "1.3.x"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
},
{
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.11.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.49:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.48:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.47:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.51:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.42:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.53:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.44:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.43:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.5.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.54:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.46:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.45:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.38:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:libpng:libpng:1.0.64:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "135555"
},
{
"db": "PACKETSTORM",
"id": "135556"
},
{
"db": "PACKETSTORM",
"id": "135557"
},
{
"db": "PACKETSTORM",
"id": "134719"
},
{
"db": "PACKETSTORM",
"id": "137932"
},
{
"db": "PACKETSTORM",
"id": "135341"
}
],
"trust": 0.6
},
"cve": "CVE-2015-8472",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2015-8472",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-86433",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "Low",
"baseScore": 7.3,
"baseSeverity": "High",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2015-8472",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-8472",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201512-189",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-86433",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2015-8472",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-86433"
},
{
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
},
{
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126. libpng of png_set_PLTE The function contains a buffer overflow vulnerability. The following versions are affected: libpng prior to 1.0.65, 1.1.x and 1.2.x prior to 1.2.55, 1.3.x, 1.4.x prior to 1.4.18, 1.5.x prior to 1.5.25, 1.6 1.6.x versions prior to .20. 5) - i386, ppc, s390x, x86_64\n\n3. Description:\n\nIBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment\nand the IBM Java Software Development Kit. \n\nThis update fixes several vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Further information\nabout these flaws can be found on the IBM Java Security alerts page, listed\nin the References section. (CVE-2015-5041, CVE-2015-7575, CVE-2015-7981,\nCVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0402, CVE-2016-0448,\nCVE-2016-0466, CVE-2016-0483, CVE-2016-0494)\n\nNote: This update also disallows the use of the MD5 hash algorithm in the\ncertification path processing. The use of MD5 can be re-enabled by removing\nMD5 from the jdk.certpath.disabledAlgorithms security property defined in\nthe java.security file. All running\ninstances of IBM Java must be restarted for the update to take effect. Bugs fixed (https://bugzilla.redhat.com/):\n\n1276416 - CVE-2015-7981 libpng: Out-of-bounds read in png_convert_to_rfc1123\n1281756 - CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions\n1289841 - CVE-2015-7575 TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)\n1291312 - CVE-2015-8540 libpng: underflow read in png_check_keyword()\n1298906 - CVE-2016-0494 ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)\n1298957 - CVE-2016-0402 OpenJDK: URL deserialization inconsistencies (Networking, 8059054)\n1299073 - CVE-2016-0448 OpenJDK: logging of RMI connection secrets (JMX, 8130710)\n1299385 - CVE-2016-0466 OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)\n1299441 - CVE-2016-0483 OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017)\n1302689 - CVE-2015-5041 IBM JDK: J9 JVM allows code to invoke non-public interface methods\n\n6. ============================================================================\nUbuntu Security Notice USN-2861-1\nJanuary 06, 2016\n\nlibpng vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 15.10\n- Ubuntu 15.04\n- Ubuntu 14.04 LTS\n- Ubuntu 12.04 LTS\n\nSummary:\n\nlibpng could be made to crash or run programs as your login if it opened a\nspecially crafted file. (CVE-2015-8472)\n\nQixue Xiao and Chen Yu discovered that libpng incorrectly handled certain\nmalformed images. (CVE-2015-8540)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 15.10:\n libpng12-0 1.2.51-0ubuntu3.15.10.2\n\nUbuntu 15.04:\n libpng12-0 1.2.51-0ubuntu3.15.04.2\n\nUbuntu 14.04 LTS:\n libpng12-0 1.2.50-1ubuntu2.14.04.2\n\nUbuntu 12.04 LTS:\n libpng12-0 1.2.46-3ubuntu4.2\n\nAfter a standard system update you need to restart your session to make\nall the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: libpng12 security update\nAdvisory ID: RHSA-2015:2595-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2015-2595.html\nIssue date: 2015-12-09\nCVE Names: CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 \n=====================================================================\n\n1. Summary:\n\nUpdated libpng12 packages that fix three security issues are now available\nfor Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which\ngive detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nThe libpng12 packages contain a library of functions for creating and\nmanipulating PNG (Portable Network Graphics) image format files. \n\nIt was discovered that the png_get_PLTE() and png_set_PLTE() functions of\nlibpng did not correctly calculate the maximum palette sizes for bit depths\nof less than 8. In case an application tried to use these functions in\ncombination with properly calculated palette sizes, this could lead to a\nbuffer overflow or out-of-bounds reads. An attacker could exploit this to\ncause a crash or potentially execute arbitrary code by tricking an\nunsuspecting user into processing a specially crafted PNG image. However,\nthe exact impact is dependent on the application using the library. An attacker could possibly use this flaw to cause an\nout-of-bounds read by tricking an unsuspecting user into processing a\nspecially crafted PNG image. (CVE-2015-7981)\n\nAll libpng12 users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nlibpng12-1.2.50-7.el7_2.src.rpm\n\nx86_64:\nlibpng12-1.2.50-7.el7_2.i686.rpm\nlibpng12-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-devel-1.2.50-7.el7_2.i686.rpm\nlibpng12-devel-1.2.50-7.el7_2.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nlibpng12-1.2.50-7.el7_2.src.rpm\n\nx86_64:\nlibpng12-1.2.50-7.el7_2.i686.rpm\nlibpng12-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-devel-1.2.50-7.el7_2.i686.rpm\nlibpng12-devel-1.2.50-7.el7_2.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nlibpng12-1.2.50-7.el7_2.src.rpm\n\naarch64:\nlibpng12-1.2.50-7.el7_2.aarch64.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.aarch64.rpm\n\nppc64:\nlibpng12-1.2.50-7.el7_2.ppc.rpm\nlibpng12-1.2.50-7.el7_2.ppc64.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.ppc.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.ppc64.rpm\n\nppc64le:\nlibpng12-1.2.50-7.el7_2.ppc64le.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.ppc64le.rpm\n\ns390x:\nlibpng12-1.2.50-7.el7_2.s390.rpm\nlibpng12-1.2.50-7.el7_2.s390x.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.s390.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.s390x.rpm\n\nx86_64:\nlibpng12-1.2.50-7.el7_2.i686.rpm\nlibpng12-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\naarch64:\nlibpng12-debuginfo-1.2.50-7.el7_2.aarch64.rpm\nlibpng12-devel-1.2.50-7.el7_2.aarch64.rpm\n\nppc64:\nlibpng12-debuginfo-1.2.50-7.el7_2.ppc.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.ppc64.rpm\nlibpng12-devel-1.2.50-7.el7_2.ppc.rpm\nlibpng12-devel-1.2.50-7.el7_2.ppc64.rpm\n\nppc64le:\nlibpng12-debuginfo-1.2.50-7.el7_2.ppc64le.rpm\nlibpng12-devel-1.2.50-7.el7_2.ppc64le.rpm\n\ns390x:\nlibpng12-debuginfo-1.2.50-7.el7_2.s390.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.s390x.rpm\nlibpng12-devel-1.2.50-7.el7_2.s390.rpm\nlibpng12-devel-1.2.50-7.el7_2.s390x.rpm\n\nx86_64:\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-devel-1.2.50-7.el7_2.i686.rpm\nlibpng12-devel-1.2.50-7.el7_2.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nlibpng12-1.2.50-7.el7_2.src.rpm\n\nx86_64:\nlibpng12-1.2.50-7.el7_2.i686.rpm\nlibpng12-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nlibpng12-debuginfo-1.2.50-7.el7_2.i686.rpm\nlibpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm\nlibpng12-devel-1.2.50-7.el7_2.i686.rpm\nlibpng12-devel-1.2.50-7.el7_2.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2015-7981\nhttps://access.redhat.com/security/cve/CVE-2015-8126\nhttps://access.redhat.com/security/cve/CVE-2015-8472\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2015 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD4DBQFWaEOWXlSAg2UNWIIRArqQAJiXHpRTjePlByUwb2yeLtnA6ZHDAJ483rVP\nN/LWwsGEwId3XWZYVPOUSQ==\n=s2GT\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. (CVE-2015-4734, CVE-2015-4803, CVE-2015-4805,\nCVE-2015-4806, CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842,\nCVE-2015-4843, CVE-2015-4844, CVE-2015-4860, CVE-2015-4871, CVE-2015-4872,\nCVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4902, CVE-2015-4903,\nCVE-2015-5006, CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126,\nCVE-2015-8472, CVE-2015-8540, CVE-2016-0264, CVE-2016-0363, CVE-2016-0376,\nCVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494,\nCVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427,\nCVE-2016-3443, CVE-2016-3449)\n\nRed Hat would like to thank Andrea Palazzo of Truel IT for reporting the\nCVE-2015-4806 issue. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update\n2016-002\n\nOS X El Capitan 10.11.4 and Security Update 2016-002 is now available\nand addresses the following:\n\napache_mod_php\nAvailable for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted .png file may lead to\narbitrary code execution\nDescription: Multiple vulnerabilities existed in libpng versions\nprior to 1.6.20. These were addressed by updating libpng to version\n1.6.20. \nCVE-ID\nCVE-2015-8126 : Adam Mari\u0161\nCVE-2015-8472 : Adam Mari\u0161\n\nAppleRAID\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1733 : Proteas of Qihoo 360 Nirvan Team\n\nAppleRAID\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: A local user may be able to determine kernel memory layout\nDescription: An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed through improved\ninput validation. \nCVE-ID\nCVE-2016-1732 : Proteas of Qihoo 360 Nirvan Team\n\nAppleUSBNetworking\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue existed in the parsing of\ndata from USB devices. This issue was addressed through improved\ninput validation. \nCVE-ID\nCVE-2016-1734 : Andrea Barisani and Andrej Rosano of Inverse Path\n\nBluetooth\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1735 : Jeonghoon Shin@A.D.D\nCVE-2016-1736 : beist and ABH of BoB\n\nCarbon\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted .dfont file may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues existed in the\nhandling of font files. These issues were addressed through improved\nbounds checking. \nCVE-ID\nCVE-2016-1737 : an anonymous researcher\n\ndyld\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An attacker may tamper with code-signed applications to\nexecute arbitrary code in the application\u0027s context\nDescription: A code signing verification issue existed in dyld. This\nissue was addressed with improved validation. \nCVE-ID\nCVE-2016-1738 : beist and ABH of BoB\n\nFontParser\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1740 : HappilyCoded (ant4g0nist and r3dsm0k3) working with\nTrend Micro\u0027s Zero Day Initiative (ZDI)\n\nHTTPProtocol\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: A remote attacker may be able to execute arbitrary code\nDescription: Multiple vulnerabilities existed in nghttp2 versions\nprior to 1.6.0, the most serious of which may have led to remote code\nexecution. These were addressed by updating nghttp2 to version 1.6.0. \nCVE-ID\nCVE-2015-8659\n\nIntel Graphics Driver\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1743 : Piotr Bania of Cisco Talos\nCVE-2016-1744 : Ian Beer of Google Project Zero\n\nIOFireWireFamily\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: A local user may be able to cause a denial of service\nDescription: A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1745 : sweetchip of Grayhash\n\nIOGraphics\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1746 : Peter Pi of Trend Micro working with Trend Micro\u0027s\nZero Day Initiative (ZDI)\nCVE-2016-1747 : Juwei Lin of Trend Micro working with Trend Micro\u0027s\nZero Day Initiative (ZDI)\n\nIOHIDFamily\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to determine kernel memory layout\nDescription: A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1748 : Brandon Azad\n\nIOUSBFamily\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1749 : Ian Beer of Google Project Zero and Juwei Lin of\nTrend Micro working with Trend Micro\u0027s Zero Day Initiative (ZDI)\n\nKernel\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A use after free issue was addressed through improved\nmemory management. \nCVE-ID\nCVE-2016-1750 : CESG\n\nKernel\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition existed during the creation of new\nprocesses. This was addressed through improved state handling. \nCVE-ID\nCVE-2016-1757 : Ian Beer of Google Project Zero and Pedro Vilaca\n\nKernel\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A null pointer dereference was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1756 : Lufeng Li of Qihoo 360 Vulcan Team\n\nKernel\nAvailable for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1754 : Lufeng Li of Qihoo 360 Vulcan Team\nCVE-2016-1755 : Ian Beer of Google Project Zero\nCVE-2016-1759 : lokihardt\n\nKernel\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to determine kernel memory layout\nDescription: An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed through improved\ninput validation. \nCVE-ID\nCVE-2016-1758 : Brandon Azad\n\nKernel\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple integer overflows were addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1753 : Juwei Lin Trend Micro working with Trend Micro\u0027s Zero\nDay Initiative (ZDI)\n\nKernel\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to cause a denial of service\nDescription: A denial of service issue was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1752 : CESG\n\nlibxml2\nAvailable for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact: Processing maliciously crafted XML may lead to unexpected\napplication termination or arbitrary code execution\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2015-1819\nCVE-2015-5312 : David Drysdale of Google\nCVE-2015-7499\nCVE-2015-7500 : Kostya Serebryany of Google\nCVE-2015-7942 : Kostya Serebryany of Google\nCVE-2015-8035 : gustavo.grieco\nCVE-2015-8242 : Hugh Davenport\nCVE-2016-1761 : wol0xff working with Trend Micro\u0027s Zero Day\nInitiative (ZDI)\nCVE-2016-1762\n\nMessages\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An attacker who is able to bypass Apple\u0027s certificate\npinning, intercept TLS connections, inject messages, and record\nencrypted attachment-type messages may be able to read attachments\nDescription: A cryptographic issue was addressed by rejecting\nduplicate messages on the client. \nCVE-ID\nCVE-2016-1788 : Christina Garman, Matthew Green, Gabriel Kaptchuk,\nIan Miers, and Michael Rushanan of Johns Hopkins University\n\nMessages\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Clicking a JavaScript link can reveal sensitive user\ninformation\nDescription: An issue existed in the processing of JavaScript links. \nThis issue was addressed through improved content security policy\nchecks. \nCVE-ID\nCVE-2016-1764 : Matthew Bryan of the Uber Security Team (formerly of\nBishop Fox), Joe DeMesy and Shubham Shah of Bishop Fox\n\nNVIDIA Graphics Drivers\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1741 : Ian Beer of Google Project Zero\n\nOpenSSH\nAvailable for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact: Connecting to a server may leak sensitive user information,\nsuch as a client\u0027s private keys\nDescription: Roaming, which was on by default in the OpenSSH client,\nexposed an information leak and a buffer overflow. These issues were\naddressed by disabling roaming in the client. \nCVE-ID\nCVE-2016-0777 : Qualys\nCVE-2016-0778 : Qualys\n\nOpenSSH\nAvailable for: OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5\nImpact: Multiple vulnerabilities in LibreSSL\nDescription: Multiple vulnerabilities existed in LibreSSL versions\nprior to 2.1.8. These were addressed by updating LibreSSL to version\n2.1.8. \nCVE-ID\nCVE-2015-5333 : Qualys\nCVE-2015-5334 : Qualys\n\nOpenSSL\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A memory leak existed in OpenSSL versions prior to\n0.9.8zh. This issue was addressed by updating OpenSSL to version\n0.9.8zh. \nCVE-ID\nCVE-2015-3195\n\nPython\nAvailable for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted .png file may lead to\narbitrary code execution\nDescription: Multiple vulnerabilities existed in libpng versions\nprior to 1.6.20. These were addressed by updating libpng to version\n1.6.20. \nCVE-ID\nCVE-2014-9495\nCVE-2015-0973\nCVE-2015-8126 : Adam Mari\u0161\nCVE-2015-8472 : Adam Mari\u0161\n\nQuickTime\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted FlashPix Bitmap Image may\nlead to unexpected application termination or arbitrary code\nexecution\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1767 : Francis Provencher from COSIG\nCVE-2016-1768 : Francis Provencher from COSIG\n\nQuickTime\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted Photoshop document may lead\nto unexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1769 : Francis Provencher from COSIG\n\nReminders\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Clicking a tel link can make a call without prompting the\nuser\nDescription: A user was not prompted before invoking a call. This\nwas addressed through improved entitlement checks. \nCVE-ID\nCVE-2016-1770 : Guillaume Ross of Rapid7 and Laurent Chouinard of\nLaurent.ca\n\nRuby\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: A local attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: An unsafe tainted string usage vulnerability existed in\nversions prior to 2.0.0-p648. This issue was addressed by updating to\nversion 2.0.0-p648. \nCVE-ID\nCVE-2015-7551\n\nSecurity\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: A local user may be able to check for the existence of\narbitrary files\nDescription: A permissions issue existed in code signing tools. This\nwas addressed though additional ownership checks. \nCVE-ID\nCVE-2016-1773 : Mark Mentovai of Google Inc. \n\nSecurity\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted certificate may lead to\narbitrary code execution\nDescription: A memory corruption issue existed in the ASN.1 decoder. \nThis issue was addressed through improved input validation. \nCVE-ID\nCVE-2016-1950 : Francis Gabriel of Quarkslab\n\nTcl\nAvailable for: \nOS X Yosemite v10.10.5 and OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted .png file may lead to\narbitrary code execution\nDescription: Multiple vulnerabilities existed in libpng versions\nprior to 1.6.20. These were addressed by removing libpng. \nCVE-ID\nCVE-2015-8126 : Adam Mari\u0161\n\nTrueTypeScaler\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription: A memory corruption issue existed in the processing of\nfont files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2016-1775 : 0x1byte working with Trend Micro\u0027s Zero Day\nInitiative (ZDI)\n\nWi-Fi\nAvailable for: OS X El Capitan v10.11 to v10.11.3\nImpact: An attacker with a privileged network position may be able\nto execute arbitrary code\nDescription: A frame validation and memory corruption issue existed\nfor a given ethertype. This issue was addressed through additional\nethertype validation and improved memory handling. \nCVE-ID\nCVE-2016-0801 : an anonymous researcher\nCVE-2016-0802 : an anonymous researcher\n\nOS X El Capitan 10.11.4 includes the security content of Safari 9.1. \nhttps://support.apple.com/kb/HT206171\n\nOS X El Capitan v10.11.4 and Security Update 2016-002 may be obtained\nfrom the Mac App Store or Apple\u0027s Software Downloads web site:\nhttp://www.apple.com/support/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - https://gpgtools.org\n\niQIcBAEBCgAGBQJW8JQFAAoJEBcWfLTuOo7tZSYP/1bHFA1qemkD37uu7nYpk/q6\nARVsPgME1I1+5tOxX0TQJgzMBmdQsKYdsTiLpDk5HTuv+dAMsFfasaUItGk8Sz1w\nHiYjSfVsxL+Pjz3vK8/4/fsi2lX6472MElRw8gudITOhXtniGcKo/vuA5dB+vM3l\nJy1NLHHhZ6BD2t0bBmlz41mZMG3AMxal2wfqE+5LkjUwASzcvC/3B1sh7Fntwyau\n/71vIgMQ5AaETdgQJAuQivxPyTlFduBRgLjqvPiB9eSK4Ctu5t/hErFIrP2NiDCi\nUhfZC48XbiRjJfkUsUD/5TIKnI+jkZxOnch9ny32dw2kUIkbIAbqufTkzsMXOpng\nO+rI93Ni7nfzgI3EkI2bq+C+arOoRiveWuJvc3SMPD5RQHo4NCQVs0ekQJKNHF78\njuPnY29n8WMjwLS6Zfm+bH+n8ELIXrmmEscRztK2efa9S7vJe+AgIxx7JE/f8OHF\ni9K7UQBXFXcpMjXi1aTby/IUnpL5Ny4NVwYwIhctj0Mf6wTH7uf/FMWYIQOXcIfP\nIzo+GXxNeLd4H2ypZ+UpkZg/Sn2mtCd88wLc96+owlZPBlSqWl3X1wTlp8i5FP2X\nqlQ7RcTHJDv8jPT/MOfzxEK1n/azp45ahHA0o6nohUdxlA7PLci9vPiJxqKPo/0q\nVZmOKa8qMxB1L/JmdCqy\n=mZR+\n-----END PGP SIGNATURE-----\n. \n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n+--------------------------+\npatches/packages/libpng-1.4.18-x86_64-1_slack14.1.txz: Upgraded. \n Fixed incorrect implementation of png_set_PLTE() that uses png_ptr\n not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126\n vulnerability. \n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472\n (* Security fix *)\n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/libpng-1.2.55-i486-1_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/libpng-1.2.55-x86_64-1_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/libpng-1.4.18-i486-1_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/libpng-1.4.18-x86_64-1_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/libpng-1.4.18-i486-1_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/libpng-1.4.18-x86_64-1_slack13.37.txz\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/libpng-1.4.18-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/libpng-1.4.18-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libpng-1.4.18-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libpng-1.4.18-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libpng-1.6.20-i586-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/libpng-1.6.20-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 13.0 package:\n0ee9224ad5684fad22c1b0c90605c63b libpng-1.2.55-i486-1_slack13.0.txz\n\nSlackware x86_64 13.0 package:\nd9b29264e8312baf0c511c81ad779e59 libpng-1.2.55-x86_64-1_slack13.0.txz\n\nSlackware 13.1 package:\n28f6f162e3808d1dcdf6a3a98a8ccd69 libpng-1.4.18-i486-1_slack13.1.txz\n\nSlackware x86_64 13.1 package:\n156846c2db1a60cc840ed6e545ad9ec3 libpng-1.4.18-x86_64-1_slack13.1.txz\n\nSlackware 13.37 package:\n6c2eb1e0434a742f837b3d136d09fa89 libpng-1.4.18-i486-1_slack13.37.txz\n\nSlackware x86_64 13.37 package:\n099974c30fce3f57ba60249e6cd4ad99 libpng-1.4.18-x86_64-1_slack13.37.txz\n\nSlackware 14.0 package:\nb546c957f439e78bbee7bdd429953a76 libpng-1.4.18-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n66903cc8d9eea2c47698ff0776da13e2 libpng-1.4.18-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\nf2dfcb4aa0a05fccf81f60f913bc7e8e libpng-1.4.18-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\nc06efdbec225394a156860a4f571dd59 libpng-1.4.18-x86_64-1_slack14.1.txz\n\nSlackware -current package:\n6f2e6e7f5f8c3760a372cc9ae3130060 l/libpng-1.6.20-i586-1.txz\n\nSlackware x86_64 -current package:\n8be8af75ec81e9463adf345c0bf48432 l/libpng-1.6.20-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the package as root:\n# upgradepkg libpng-1.4.18-i486-1_slack14.1.txz\n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list: |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message: |\n| |\n| unsubscribe slackware-security |\n| |\n| You will get a confirmation message back containing instructions to |\n| complete the process. Please do not reply to this email address",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-8472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "VULHUB",
"id": "VHN-86433"
},
{
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"db": "PACKETSTORM",
"id": "135555"
},
{
"db": "PACKETSTORM",
"id": "135556"
},
{
"db": "PACKETSTORM",
"id": "135557"
},
{
"db": "PACKETSTORM",
"id": "135153"
},
{
"db": "PACKETSTORM",
"id": "134719"
},
{
"db": "PACKETSTORM",
"id": "137932"
},
{
"db": "PACKETSTORM",
"id": "135341"
},
{
"db": "PACKETSTORM",
"id": "136346"
},
{
"db": "PACKETSTORM",
"id": "134874"
}
],
"trust": 2.61
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-86433",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-86433"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-8472",
"trust": 3.5
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2015/12/03/6",
"trust": 1.2
},
{
"db": "MCAFEE",
"id": "SB10148",
"trust": 1.2
},
{
"db": "BID",
"id": "78624",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97668313",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201512-189",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "135153",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "134874",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "135265",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-86433",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2015-8472",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135555",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135556",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135557",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134719",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "137932",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135341",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "136346",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-86433"
},
{
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "PACKETSTORM",
"id": "135555"
},
{
"db": "PACKETSTORM",
"id": "135556"
},
{
"db": "PACKETSTORM",
"id": "135557"
},
{
"db": "PACKETSTORM",
"id": "135153"
},
{
"db": "PACKETSTORM",
"id": "134719"
},
{
"db": "PACKETSTORM",
"id": "137932"
},
{
"db": "PACKETSTORM",
"id": "135341"
},
{
"db": "PACKETSTORM",
"id": "136346"
},
{
"db": "PACKETSTORM",
"id": "134874"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
},
{
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"id": "VAR-201601-0495",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-86433"
}
],
"trust": 0.01
},
"last_update_date": "2024-07-23T20:27:47.728000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/mar/msg00004.html"
},
{
"title": "HT206167",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht206167"
},
{
"title": "HT206167",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht206167"
},
{
"title": "Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices",
"trust": 0.8,
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2016verbose-2367956.html"
},
{
"title": "Oracle Critical Patch Update Advisory - January 2016",
"trust": 0.8,
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
},
{
"title": "January 2016 Critical Patch Update Released",
"trust": 0.8,
"url": "https://blogs.oracle.com/security/entry/january_2016_critical_patch_update"
},
{
"title": "libpng10 / 1.0.65",
"trust": 0.8,
"url": "http://sourceforge.net/projects/libpng/files/libpng10/1.0.65/"
},
{
"title": "libpng12 / 1.2.55",
"trust": 0.8,
"url": "http://sourceforge.net/projects/libpng/files/libpng12/1.2.55/"
},
{
"title": "libpng14 / 1.4.18",
"trust": 0.8,
"url": "http://sourceforge.net/projects/libpng/files/libpng14/1.4.18/"
},
{
"title": "libpng15 / 1.5.25",
"trust": 0.8,
"url": "http://sourceforge.net/projects/libpng/files/libpng15/1.5.25/"
},
{
"title": "libpng16 / 1.6.20",
"trust": 0.8,
"url": "http://sourceforge.net/projects/libpng/files/libpng16/1.6.20/"
},
{
"title": "TLSA-2016-11",
"trust": 0.8,
"url": "http://www.turbolinux.co.jp/security/2016/tlsa-2016-11j.html"
},
{
"title": "Oracle Corporation Java\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u8106\u5f31\u6027\u306b\u95a2\u3059\u308b\u304a\u77e5\u3089\u305b",
"trust": 0.8,
"url": "http://www.fmworld.net/biz/common/oracle/20160120.html"
},
{
"title": "libpng Buffer Overflow Vulnerability Fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=59039"
},
{
"title": "Red Hat: Moderate: libpng security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20152596 - security advisory"
},
{
"title": "Red Hat: Moderate: libpng12 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20152595 - security advisory"
},
{
"title": "Red Hat: Moderate: libpng security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20152594 - security advisory"
},
{
"title": "Debian CVElist Bug Report Logs: libpng: CVE-2015-8540: read underflow in libpng",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=0a130e26709c1ba00694161c08b9c604"
},
{
"title": "Ubuntu Security Notice: libpng vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-2861-1"
},
{
"title": "Debian CVElist Bug Report Logs: libpng: Incomplete fix for CVE-2015-8126",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=386e683fecec564e81371b5dca873869"
},
{
"title": "Debian Security Advisories: DSA-3443-1 libpng -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=57e4bc5fc071e2986f7cef65414ffe23"
},
{
"title": "Red Hat: CVE-2015-8472",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2015-8472"
},
{
"title": "Amazon Linux AMI: ALAS-2015-615",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2015-615"
},
{
"title": "Apple: OS X El Capitan v10.11.4 and Security Update 2016-002",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=ef054ba76412200e34091eb91c38c281"
},
{
"title": "Oracle Linux Bulletins: Oracle Linux Bulletin - October 2015",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins\u0026qid=435ed9abc2fb1e74ce2a69605a01e326"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - January 2016",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=63802a6c83b107c4e6e0c7f9241a66a8"
},
{
"title": "IBM: Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics for NPS",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=c36fc403a4c2c6439b732d2fca738f58"
},
{
"title": "clair-lab",
"trust": 0.1,
"url": "https://github.com/sjourdan/clair-lab "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-86433"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.3,
"url": "http://www.securityfocus.com/bid/78624"
},
{
"trust": 1.3,
"url": "http://rhn.redhat.com/errata/rhsa-2015-2595.html"
},
{
"trust": 1.3,
"url": "http://rhn.redhat.com/errata/rhsa-2016-0056.html"
},
{
"trust": 1.3,
"url": "https://access.redhat.com/errata/rhsa-2016:1430"
},
{
"trust": 1.2,
"url": "http://lists.apple.com/archives/security-announce/2016/mar/msg00004.html"
},
{
"trust": 1.2,
"url": "http://sourceforge.net/projects/libpng/files/libpng10/1.0.65/"
},
{
"trust": 1.2,
"url": "http://sourceforge.net/projects/libpng/files/libpng12/1.2.55/"
},
{
"trust": 1.2,
"url": "http://sourceforge.net/projects/libpng/files/libpng14/1.4.18/"
},
{
"trust": 1.2,
"url": "http://sourceforge.net/projects/libpng/files/libpng15/1.5.25/"
},
{
"trust": 1.2,
"url": "http://sourceforge.net/projects/libpng/files/libpng16/1.6.20/"
},
{
"trust": 1.2,
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
},
{
"trust": 1.2,
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"trust": 1.2,
"url": "https://support.apple.com/ht206167"
},
{
"trust": 1.2,
"url": "http://www.debian.org/security/2016/dsa-3443"
},
{
"trust": 1.2,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-january/174936.html"
},
{
"trust": 1.2,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-january/175073.html"
},
{
"trust": 1.2,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-january/174905.html"
},
{
"trust": 1.2,
"url": "http://www.openwall.com/lists/oss-security/2015/12/03/6"
},
{
"trust": 1.2,
"url": "http://rhn.redhat.com/errata/rhsa-2015-2594.html"
},
{
"trust": 1.2,
"url": "http://rhn.redhat.com/errata/rhsa-2015-2596.html"
},
{
"trust": 1.2,
"url": "http://rhn.redhat.com/errata/rhsa-2016-0055.html"
},
{
"trust": 1.2,
"url": "http://rhn.redhat.com/errata/rhsa-2016-0057.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html"
},
{
"trust": 1.2,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html"
},
{
"trust": 1.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10148"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8472"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-8472"
},
{
"trust": 0.8,
"url": "https://www.ipa.go.jp/security/ciadr/vul/20160120-jre.html"
},
{
"trust": 0.8,
"url": "http://www.jpcert.or.jp/at/2016/at160005.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97668313"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8472"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-8126"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/cve/cve-2015-8126"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.6,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.6,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/cve/cve-2015-8472"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics-for-nps/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-jre-8-0-1-1-affect-ibm-netezza-platform-software-clients/"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2016-0448"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7575"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2015-7575"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2016-0483"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2016-0402"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2016-0466"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2016-0494"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0448"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0466"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0483"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5041"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2015-7981"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-8540"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0494"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2015-5041"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7981"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0402"
},
{
"trust": 0.3,
"url": "http://www.ibm.com/developerworks/java/jdk/alerts/"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2015-8540"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10148"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2015:2596"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/2861-1/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=43094"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2016-0100.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0475"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2016-0098.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0475"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2016-0099.html"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/libpng/1.2.51-0ubuntu3.15.04.2"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-2861-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/libpng/1.2.51-0ubuntu3.15.10.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/libpng/1.2.46-3ubuntu4.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/libpng/1.2.50-1ubuntu2.14.04.2"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4883"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4840"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-3422"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4882"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4903"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4872"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4844"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4806"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-3449"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0363"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0264"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4871"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4860"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4893"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4871"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0376"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4803"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4840"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0376"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4734"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4860"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4842"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4843"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4835"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4903"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4805"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4902"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4883"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4810"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4805"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4893"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-3443"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0363"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4882"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4842"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4843"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4835"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4810"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4902"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4872"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0686"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-3426"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4734"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4803"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-4806"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-4844"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-5006"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-3427"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5006"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0687"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0264"
},
{
"trust": 0.1,
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#appendixjava"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7551"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0777"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-8659"
},
{
"trust": 0.1,
"url": "https://gpgtools.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-8035"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1819"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3195"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7499"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0801"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-8242"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht206171"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1732"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5312"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7942"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7500"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-9495"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1734"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1740"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5334"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1733"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1736"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1735"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0778"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5333"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0802"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1738"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1737"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-0973"
},
{
"trust": 0.1,
"url": "http://slackware.com"
},
{
"trust": 0.1,
"url": "http://osuosl.org)"
},
{
"trust": 0.1,
"url": "http://slackware.com/gpg-key"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-86433"
},
{
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "PACKETSTORM",
"id": "135555"
},
{
"db": "PACKETSTORM",
"id": "135556"
},
{
"db": "PACKETSTORM",
"id": "135557"
},
{
"db": "PACKETSTORM",
"id": "135153"
},
{
"db": "PACKETSTORM",
"id": "134719"
},
{
"db": "PACKETSTORM",
"id": "137932"
},
{
"db": "PACKETSTORM",
"id": "135341"
},
{
"db": "PACKETSTORM",
"id": "136346"
},
{
"db": "PACKETSTORM",
"id": "134874"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
},
{
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-86433"
},
{
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"db": "PACKETSTORM",
"id": "135555"
},
{
"db": "PACKETSTORM",
"id": "135556"
},
{
"db": "PACKETSTORM",
"id": "135557"
},
{
"db": "PACKETSTORM",
"id": "135153"
},
{
"db": "PACKETSTORM",
"id": "134719"
},
{
"db": "PACKETSTORM",
"id": "137932"
},
{
"db": "PACKETSTORM",
"id": "135341"
},
{
"db": "PACKETSTORM",
"id": "136346"
},
{
"db": "PACKETSTORM",
"id": "134874"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
},
{
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-01-21T00:00:00",
"db": "VULHUB",
"id": "VHN-86433"
},
{
"date": "2016-01-21T00:00:00",
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"date": "2016-01-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"date": "2016-02-02T16:43:57",
"db": "PACKETSTORM",
"id": "135555"
},
{
"date": "2016-02-02T16:44:07",
"db": "PACKETSTORM",
"id": "135556"
},
{
"date": "2016-02-02T16:44:12",
"db": "PACKETSTORM",
"id": "135557"
},
{
"date": "2016-01-07T00:11:25",
"db": "PACKETSTORM",
"id": "135153"
},
{
"date": "2015-12-10T00:39:51",
"db": "PACKETSTORM",
"id": "134719"
},
{
"date": "2016-07-18T19:51:43",
"db": "PACKETSTORM",
"id": "137932"
},
{
"date": "2016-01-21T14:47:53",
"db": "PACKETSTORM",
"id": "135341"
},
{
"date": "2016-03-22T15:18:02",
"db": "PACKETSTORM",
"id": "136346"
},
{
"date": "2015-12-16T20:23:10",
"db": "PACKETSTORM",
"id": "134874"
},
{
"date": "2015-12-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-189"
},
{
"date": "2016-01-21T15:59:00.117000",
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-11-04T00:00:00",
"db": "VULHUB",
"id": "VHN-86433"
},
{
"date": "2017-11-04T00:00:00",
"db": "VULMON",
"id": "CVE-2015-8472"
},
{
"date": "2016-05-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006846"
},
{
"date": "2021-05-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-189"
},
{
"date": "2017-11-04T01:29:12.600000",
"db": "NVD",
"id": "CVE-2015-8472"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "libpng of png_set_PLTE Buffer overflow vulnerability in functions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006846"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-189"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.