Detections
Analytics
OracleVM 3.2 : nspr (OVMSA-2016-0065)
high Nessus Plugin ID 91746
Language:
Synopsis
The remote OracleVM host is missing a security update.Description
The remote OracleVM system is missing necessary patches to address critical security updates :- Rebase to NSPR 4.11
- Resolves: Bug 1297943 - Rebase RHEL 5.11.z to NSPR 4.11 in preparation for Firefox 45
- Resolves: Bug 1269359 - (CVE-2015-7183)
- nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption [rhel-5.11.z]
- Rebase to nspr-4.10.8
- Resolves: Bug 1200921 - Rebase nspr to 4.10.8 for Firefox 38 ESR
- Rebase to nspr-4.10.6
- Resolves: Bug 1110857 - Rebase nspr in RHEL 5.11 to NSPR 4.10.6 for FF31
- Retagging
- Resolves: rhbz#1032468
- Remove an unused patch
- Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606 (CVE-2013-1741) nss: various flaws [rhel-5.11]
- Update to nspr-4.10.2
- Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606 (CVE-2013-1741) nss: various flaws [rhel-5.11]
- Retagging to fix an inconsitency in the release tags
- Resolves: rhbz#1002641 - Rebase RHEL 5 to NSPR 4.10 (for FF 24.x)
- Rebase to nspr-4.10.0
- Resolves: rhbz#1002641 - Rebase RHEL 5 to NSPR 4.10 (for FF 24.x)
- Resolves: rhbz#737704 - Fix spec file test script typo and enable running the test suites
- Resolves: rhbz#919183 - Rebase to nspr-4.9.5
- Resolves: rhbz#883777- [RFE] Rebase nspr to 4.9.2 due to Firefox 17 ESR
- Resolves: rhbz#633519 - pthread_key_t leak and memory corruption
- Resolves: rhbz#831654 - Fix %post and %postun
- Updated License: to MPLv2.0 per upstream
- Resolves: rhbz#831654 - Pick up fixes from the rhel-5.8 branch
- Regenerated nspr-config-pc.patch passes the the rpmdiff tests
- Resolves: rhbz#831654 - restore top section of nspr-config-pc.patch
- Needed to prevent multilib regressions
- Resolves: rhbz#831654 - revert unwanted changes to nspr.pc
- Change@/nspr4 to@ in the patch
- Update to NSPR_4_9_1_RTM
- Resolves: rhbz#831654
- rebuilt
- Resolves: Bug 772945 - [RFE] Async update nspr to make firefox 10 LTS rebase possible
- Update to 4.8.9
- Bumping the relase tag so it's higher than the one in 5.7-z
- Update to 4.8.8
Solution
Update the affected nspr package.See Also
https://oss.oracle.com/pipermail/oraclevm-errata/2016-June/000485.html
Plugin Details
Severity: High
ID: 91746
File Name: oraclevm_OVMSA-2016-0065.nasl
Version: 2.5
Type: local
Family: OracleVM Local Security Checks
Published: 6/22/2016
Updated: 1/4/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:oracle:vm:nspr, cpe:/o:oracle:vm_server:3.2
Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 6/21/2016
Vulnerability Publication Date: 11/18/2013
Reference Information
CVE: CVE-2013-1741, CVE-2013-5605, CVE-2013-5606, CVE-2015-7183