The remote OracleVM system is missing necessary patches to address critical security updates :

  - Prevent downgrade attack to RSA-MD5 in TLS 1.2 server     key exchange (#1289885)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added nss-vendor.patch to change vendor

  - Prevent TLS 1.2 Transcript Collision attacks against MD5     in key exchange protocol

  - Resolves: Bug 1289881

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix memory corruption in PMAP_CALLIT code (bz 1283638)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2

  - fix CVE-2015-3194 - certificate verify crash with     missing PSS parameter

  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak

  - fix CVE-2015-3196 - race condition when handling PSK     identity hint

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2015-8000)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-3194 - certificate verify crash with     missing PSS parameter

  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak

  - fix CVE-2015-3196 - race condition when handling PSK     identity hint

The remote OracleVM system is missing necessary patches to address critical security updates :

  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)     [Orabug: 22333698] (CVE-2015-8104)

  - KVM: x86: work around infinite loop in microcode when     #AC is delivered (Eric Northup) [Orabug: 22333689]     (CVE-2015-5307) (CVE-2015-5307)

  - KVM: x86: Defining missing x86 vectors (Nadav Amit)     [Orabug: 22333689]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Security fix for (CVE-2015-7981, CVE-2015-8126)

  - Resolves: #1283572

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix-up bad changelog dates

  - guard against undue super page PTE creation XSA-148 (Jan     Beulich)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update doc/redhat.gif in tarball

  - Add libxml2-oracle-enterprise.patch and update logos in     tarball

  - Fix a series of CVEs (rhbz#1286495)

  - CVE-2015-7941 Cleanup conditional section error handling

  - CVE-2015-8317 Fail parsing early on if encoding     conversion failed

  - CVE-2015-7942 Another variation of overflow in     Conditional sections

  - CVE-2015-7942 Fix an error in previous Conditional     section patch

  - Fix parsing short unclosed comment uninitialized access

  - CVE-2015-7498 Avoid processing entities after encoding     conversion failures

  - CVE-2015-7497 Avoid an heap buffer overflow in     xmlDictComputeFastQKey

  - CVE-2015-5312 Another entity expansion issue

  - CVE-2015-7499 Add xmlHaltParser to stop the parser

  - CVE-2015-7499 Detect incoherency on GROW

  - CVE-2015-7500 Fix memory access error due to incorrect     entities boundaries

  - CVE-2015-8242 Buffer overead with HTML parser in push     mode

  - Libxml violates the zlib interface and crashes

The remote OracleVM system is missing necessary patches to address critical security updates :

  - ipc/sem.c: fully initialize sem_array before making it     visible (Manfred Spraul) [Orabug: 22277382]     (CVE-2015-7613)

  - ipc: fix msg newqueue add (Guru Anbalagane) [Orabug:
    22277382] (CVE-2015-7613)

  - sctp: fix race on protocol/netns initialization (Marcelo     Ricardo Leitner) [Orabug: 22249981] (CVE-2015-5283)

  - Initialize msg/shm IPC objects before doing ipc_addid     (Linus Torvalds) [Orabug: 22250045] (CVE-2015-7613)

  - ixgbe: reset copper phy power mode (Ethan Zhao) [Orabug:
    22271769]

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0147 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: rate-limit logging in do_xen[oprof,pmu]_op Some of     the sub-ops are acessible to all guests, and hence     should be rate-limited. In the xenoprof case, just like     for XSA-146, include them only in debug builds. Since     the vPMU code is rather new, allow them to be always     present, but downgrade them to (rate limited) guest     messages. This is XSA-152. (CVE-2015-7971)

  - xenoprof: free domain's vcpu array This was overlooked     in fb442e2171 ('x86_64: allow more vCPU-s per guest').
    This is XSA-151. (CVE-2015-7969)

  - x86: guard against undue super page PTE creation When     optional super page support got added (commit bd1cd81d64     'x86: PV support for hugepages'), two adjustments were     missed: mod_l2_entry needs to consider the PSE and RW     bits when deciding whether to use the fast path, and the     PSE bit must not be removed from L2_DISALLOW_MASK     unconditionally. This is XSA-148.

    [backport to Xen 4.1] (CVE-2015-7835)

The remote OracleVM system is missing necessary patches to address critical security updates :

nspr

  - Resolves: Bug 1269360 - (CVE-2015-7183)

  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead     to crash (under ASAN), potential memory corruption

nss

  - Added nss-vendor.patch to change vendor

  - Rebuild against updated NSPR

  - Sync up with the rhel-6.6 branch

  - Resolves: Bug 1224450

nss-util

  - Resolves: Bug 1269355 - CVE-2015-7182 (CVE-2015-7181)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - virtio-net: drop NETIF_F_FRAGLIST (Jason Wang) [Orabug:
    22145600] (CVE-2015-5156)

  - netdev: fix NETIF_F_GSO_UDP_TUNNEL_BIT enum shift in     i40e driver import (Todd Vierling) [Orabug: 22066176]

  - xen/blkfront: remove redundant flush_op (Vitaly     Kuznetsov) [Orabug: 21868758] - xen/blkfront: improve     protection against issuing unsupported REQ_FUA (Vitaly     Kuznetsov) [Orabug: 21868758]

  - xen-blkfront: introduce blkfront_gather_backend_features     (Bob Liu) [Orabug: 20190614] - sched/x86: Fix up typo in     topology detection (Dave Hansen) [Orabug: 21845184]

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0142 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: rate-limit logging in do_xen[oprof,pmu]_op Some of     the sub-ops are acessible to all guests, and hence     should be rate-limited. In the xenoprof case, just like     for XSA-146, include them only in debug builds. Since     the vPMU code is rather new, allow them to be always     present, but downgrade them to (rate limited) guest     messages. This is XSA-152. (CVE-2015-7971)

  - xenoprof: free domain's vcpu array This was overlooked     in fb442e2171 ('x86_64: allow more vCPU-s per guest').
    This is XSA-151. (CVE-2015-7969)

  - x86: guard against undue super page PTE creation When     optional super page support got added (commit bd1cd81d64     'x86: PV support for hugepages'), two adjustments were     missed: mod_l2_entry needs to consider the PSE and RW     bits when deciding whether to use the fast path, and the     PSE bit must not be removed from L2_DISALLOW_MASK     unconditionally. This is XSA-148. (CVE-2015-7835)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - check origin timestamp before accepting KoD RATE packet     (CVE-2015-7704)

  - allow only one step larger than panic threshold with -g     (CVE-2015-5300)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-6908 openldap: ber_get_next denial of service     vulnerability (#1263171)

  - fix: nslcd segfaults due to incorrect mutex     initialization (#1144294)

  - fix: Updating openldap deletes database if slapd.conf is     used (#1193519)

  - fix: ppc64: slaptest segfault in openldap-2.4.40     (#1202696)

  - fix: bring back accidentaly removed patch (#1147983)

  - rebase to 2.4.40 (#1147983)

  - fix: make /etc/openldap/check_password.conf readable by     ldap (#1155390)

  - revert previous patch (#1172296)

  - fix: crash in ldap_domain2hostlist when processing SRV     record (#1164369)

  - support TLS 1.1 and later (#1160467)

  - enhancement: add ppolicy-check-password (#1155390)

  - fix: prevent freed memory reuse (#1172296)

  - fix: provide a shim libldif.so (#1110382)

  - fix: remove correct tmp file when generating server cert     (#1102083)

  - remove unapplied patches

  - fix: TLS_REQCERT documentation in client manpage     (#1027796)

  - review %configure and remove nonexistent options

  - add another missing patch forgotten during the rebase

  - fix: enable dynamic linking - unresolved symbols in the     smbk5pwd module

  - add missing patches that were removed by mistake during     the rebase

  - rebase to 2.4.39 (#923680)

  + drop a lot of upstreamed patches, backport the rest

  + compile in mdb

  + remove automatic slapd.conf -> slapd-config conversion

  - fix: segfault on certain queries with rwm overlay     (#1003038)

  - fix: deadlock during SSL_ForceHandshake (#996373)

  + revert nss-handshake-threadsafe.patch

The remote OracleVM system is missing necessary patches to address critical security updates :

  - sctp: fix ASCONF list handling (Marcelo Ricardo Leitner)     [Orabug: 21842668] (CVE-2015-3212)

  - KEYS: ensure we free the assoc array edit if edit is     valid (Colin Ian King) [Orabug: 21842655]     (CVE-2015-1333)

  - Introduce [compat_]save_altstack_ex to unbreak x86 SMAP     (Al Viro) [Orabug: 21549587] - x86, smap: Handle     csum_partial_copy_*_user (H. Peter Anvin) [Orabug:
    21549587] - ext4: fix warning in     ext4_da_update_reserve_space (Jan Kara) [Orabug:
    21621442] - ext4: remove unused variable in     ext4_free_blocks (Lukas Czerner) [Orabug: 21621442] -     quota: provide interface for readding allocated space     into reserved space (Jan Kara) [Orabug: 21621442]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-1802: missing range check in bdfReadProperties     (bug 1258892)

  - CVE-2015-1803: crash on invalid read in     bdfReadCharacters (bug 1258892)

  - CVE-2015-1804: out-of-bounds memory access in     bdfReadCharacters (bug 1258892)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Apply previously not applied patch for (CVE-2015-5722)

  - Fix (CVE-2015-5722)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Pick up upstream freebl patch for (CVE-2015-2730)

  - Check for P == Q or P ==-Q before adding P and Q

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-3238 - DoS due to blocking pipe with very     long password

  - make pam_pwhistory and pam_unix tolerant of opasswd file     corruption

  - pam_userdb: allow any crypt hash algorithm to be used     (#1119289)

  - pam_cracklib: improve documentation (#889233)

  - unbreak authentication if ld.so.preload is not empty

  - correct off by one error in account expiration     calculation (#947011)

  - pam_console_apply: do not print error if console.perms.d     is empty

  - properly handle all cases where crypt might return NULL     (#1026203)

  - pam_limits: clarify documentation of maxsyslogins limit     (#1028490)

  - pam_access: call DNS resolution only when necessary and     cache results (#1029817)

  - pam_limits: nofile applies to file descriptors not files     (#1040664)

  - pam_limits: check whether the utmp login entry is valid     (#1054936)

  - correct URLs in spec file (#1071770)

  - pam_userdb: correct the example in man page (#1078779)

  - pam_selinux: canonicalize username for getseuser     (#1083981)

  - pam_access: fix netgroup matching and @user@@netgroup     parsing (#740233)

  - pam_tty_audit: allow for runtime backwards compatibility     with old kernels

  - add option to pam_tty_audit to disable auditing of     password input

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add Oracle ACFS to hrStorage (John Haxby) [orabug     18510373]

  - Fixed parsing of invalid variables in incoming packets     (#1248410)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add patch for compiler warnings highlighted by rpmdiff.
    Related: rhbz#1244727

  - fix for (CVE-2015-3416) Resolves: #1244727

The remote OracleVM system is missing necessary patches to address critical security updates :

  - udp: fix behavior of wrong checksums (Eric Dumazet)     [Orabug: 21628850] (CVE-2015-5364) (CVE-2015-5366)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - md: use kzalloc when bitmap is disabled (Benjamin     Randazzo) [Orabug: 21563041] (CVE-2015-5697)

The remote OracleVM system is missing necessary patches to address critical security updates in xen.

The remote OracleVM system is missing necessary patches to address critical security updates in xen

The remote OracleVM system is missing necessary patches to address critical security updates in kernel-uek.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - require credentials to match for NTLM re-use     (CVE-2015-3143)

  - close Negotiate connections when done (CVE-2015-3148)

  - reject CRLFs in URLs passed to proxy (CVE-2014-8150)

  - use only full matches for hosts used as IP address in     cookies (CVE-2014-3613)

  - fix handling of CURLOPT_COPYPOSTFIELDS in     curl_easy_duphandle (CVE-2014-3707)

  - fix manpage typos found using aspell (#1011101)

  - fix comments about loading CA certs with NSS in man     pages (#1011083)

  - fix handling of DNS cache timeout while a transfer is in     progress (#835898)

  - eliminate unnecessary inotify events on upload via file     protocol (#883002)

  - use correct socket type in the examples (#997185)

  - do not crash if MD5 fingerprint is not provided by     libssh2 (#1008178)

  - fix SIGSEGV of curl --retry when network is down     (#1009455)

  - allow to use TLS 1.1 and TLS 1.2 (#1012136)

  - docs: update the links to cipher-suites supported by NSS     (#1104160)

  - allow to use ECC ciphers if NSS implements them     (#1058767)

  - make curl --trace-time print correct time (#1120196)

  - let tool call PR_Cleanup on exit if NSPR is used     (#1146528)

  - ignore CURLOPT_FORBID_REUSE during NTLM HTTP auth     (#1154747)

  - allow to enable/disable new AES cipher-suites (#1156422)

  - include response headers added by proxy in     CURLINFO_HEADER_SIZE (#1161163)

  - disable libcurl-level downgrade to SSLv3 (#1154059)

  - do not force connection close after failed HEAD request     (#1168137)

  - fix occasional SIGSEGV during SSL handshake (#1168668)

  - fix a connection failure when FTPS handle is reused     (#1154663)

  - fix re-use of wrong HTTP NTLM connection (CVE-2014-0015)

  - fix connection re-use when using different log-in     credentials (CVE-2014-0138)

  - fix authentication failure when server offers multiple     auth options (#799557)

  - refresh expired cookie in test172 from upstream     test-suite (#1069271)

  - fix a memory leak caused by write after close (#1078562)

  - nss: implement non-blocking SSL handshake (#1083742)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update CVE-2015-3246 patch based on review comments     Resolves: #1235518

  - Don&rsquo t use 512-bit RSA private keys in tests     Related: #1235518

  - Fix testsuite failures if more than one architecture is     building concurrently Related: #1235518

  - Fix (CVE-2015-3246) Resolves: #1235518

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix (CVE-2015-5477)

  - Fix (CVE-2015-4620)

  - Resolves: 1215687 - DNS resolution failure in high load     environment with SERVFAIL and 'out of memory/success' in     the log

  - Fix (CVE-2015-1349)

  - Enable RPZ-NSIP and RPZ-NSDNAME during compilation     (#1176476)

  - Fix race condition when using isc__begin_beginexclusive     (#1175321)

  - Sanitize SDB API to better handle database errors     (#1146893)

  - Fix CVE-2014-8500 (#1171974)

  - Fix RRL slip behavior when set to 1 (#1112356)

  - Fix issue causing bind to hang after reload if using     DYNDB (#1142152)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - KVM: x86: SYSENTER emulation is broken (Nadav Amit)     [Orabug: 21502739] (CVE-2015-0239) (CVE-2015-0239)

  - fs: take i_mutex during prepare_binprm for set[ug]id     executables (Jann Horn) [Orabug: 21502254]     (CVE-2015-3339)

  - eCryptfs: Remove buggy and unnecessary write in file     name decode routine (Michael Halcrow) [Orabug: 21502065]     (CVE-2014-9683)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - RHEL-6.7 erratum

  - modified the authlogicfix patch to fix #1144448

  - fixed a bug in the ldapusermatchfix patch Resolves:
    rhbz#1144448 Resolves: rhbz#1142122

  - RHEL-6.7 erratum

  - fixed the mantypos-ldap.patch Resolves: rhbz#1138267

  - RHEL-6.7 erratum

  - added patch for (CVE-2014-9680)

  - added BuildRequires for tzdata Resolves: rhbz#1200253

  - RHEL-6.7 erratum

  - added zlib-devel build required to enable zlib     compression support

  - fixed two typos in the sudoers.ldap man page

  - fixed a hang when duplicate nss entries are specified in     nsswitch.conf

  - SSSD: implemented sorting of the result entries     according to the sudoOrder attribute

  - LDAP: fixed logic handling the computation of the 'user     matched' flag

  - fixed restoring of the SIGPIPE signal in the tgetpass     function

  - fixed listpw, verifypw + authenticate option logic in     LDAP/SSSD Resolves: rhbz#1106433 Resolves: rhbz#1138267     Resolves: rhbz#1147498 Resolves: rhbz#1138581 Resolves:
    rhbz#1142122 Resolves: rhbz#1094548 Resolves:
    rhbz#1144448

  - RHEL-6.6 erratum

  - SSSD: dropped the ipahostnameshort patch, as it is not     needed. rhbz#1033703 is a configuration issue. Related:
    rhbz#1033703

  - RHEL-6.6 erratum

  - SSSD: fixed netgroup filter patch

  - SSSD: dropped serparate patch for #1006463, the fix is     now part of the netgroup filter patch Resolves:
    rhbz#1006463 Resolves: rhbz#1083064

  - RHEL-6.6 erratum

  - don't retry authentication when ctrl-c pressed

  - fix double-quote processing in Defaults options

  - fix sesh login shell argv[0]

  - handle the '(none)' hostname correctly

  - SSSD: fix ipa_hostname handling

  - SSSD: fix sudoUser netgroup specification filtering

  - SSSD: list correct user when -U <user> -l specified

  - SSSD: show rule names on long listing (-ll) Resolves:
    rhbz#1065415 Resolves: rhbz#1078338 Resolves:
    rhbz#1052940 Resolves: rhbz#1083064 Resolves:
    rhbz#1033703 Resolves: rhbz#1006447 Resolves:
    rhbz#1006463 Resolves: rhbz#1070952

The remote OracleVM system is missing necessary patches to address critical security updates :

  - reject packets without MAC when authentication is     enabled (CVE-2015-1798)

  - protect symmetric associations with symmetric key     against DoS attack (CVE-2015-1799)

  - fix generation of MD5 keys with ntp-keygen on big-endian     systems (CVE-2015-3405)

  - log when stepping clock for leap second or ignoring it     with -x (#1204625)

  - fix typos in ntpd man page (#1194463)

  - validate lengths of values in extension fields     (CVE-2014-9297)

  - drop packets with spoofed source address ::1     (CVE-2014-9298)

  - add nanosecond support to SHM refclock (#1117704)

  - allow creating all SHM segments with owner-only access     (#1122015)

  - allow symmetric keys up to 32 bytes again (#1053551)

  - fix calculation of root dispersion (#1045376)

  - fix crash in ntpq mreadvar command (#1165141)

  - don't step clock for leap second with -x option     (#1190619)

  - don't drop packets with source port below 123 (#1171630)

  - use larger RSA exponent in ntp-keygen (#1184421)

  - refresh peers on routing updates (#1193850)

  - increase memlock limit again (#1053568)

  - warn when monitor can't be disabled due to limited     restrict (#1166596)

  - improve documentation of restrict command (#1069019)

  - update logconfig documentation for patched default     (#1193849)

  - don't build ntpsnmpd (#995134)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-0282 (#1198159)

  - fix CVE-2015-0294 (#1198159)

  - Corrected value initialization in mpi printing     (#1129241)

  - Check for expiry information in the CA certificates     (#1159778)

  - fix issue with integer padding in certificates and keys     (#1036385)

  - fix session ID length check (#1102025)

  - fix CVE-2014-0092 (#1069891)

  - fix CVE-2013-2116 - fix DoS regression in     (CVE-2013-1619) upstream patch (#966754)

  - fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Updated pcre buildrequires to require pcre-devel >=     7.8-7

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add Oracle ACFS to hrStorage (John Haxby) [orabug     18510373]

  - Quicker loading of IP-MIB::ipAddrTable (#1191393)

  - Quicker loading of IP-MIB::ipAddressTable (#1191393)

  - Fixed snmptrapd crash when '-OQ' parameter is used and     invalid trap is received (#CVE-2014-3565)

  - added faster caching into IP-MIB::ipNetToMediaTable     (#789500)

  - fixed compilation with '-Werror=format-security'     (#1181994)

  - added clear error message when port specified in     'clientaddrr' config option cannot be bound (#886468)

  - fixed error check in IP-MIB::ipAddressTable (#1012430)

  - fixed agentx client crash on failed response (#1023570)

  - fixed dashes in net-snmp-config.h (#1034441)

  - fixed crash on monitor trigger (#1050970)

  - fixed 'netsnmp_assert 1 == new_val->high failed' message     in system log (#1065210)

  - fixed parsing of 64bit counters from SMUX subagents     (#1069046)

  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines     with >100 CPUs (#1070075)

  - fixed net-snmp-create-v3-user to have the same content     on 32 and 64bit installations (#1073544)

  - fixed IPADDRESS value length in Python bindings     (#1100099)

  - fixed hrStorageTable to contain 31 bits integers     (#1104293)

  - fixed links to developer man pages (#1119567)

  - fixed storageUseNFS functionality in hrStorageTable     (#1125793)

  - fixed netsnmp_set Python bindings call truncating at the     first '\000' character (#1126914)

  - fixed log level of SMUX messages (#1140234)

  - use python/README to net-snmp-python subpackage     (#1157373)

  - fixed forwarding of traps with RequestID=0 in snmptrapd     (#1146948)

  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)

  - fixed close overhead of extend commands (#1188295)

  - fixed lmSensorsTable not reporting sensors with     duplicate names (#967871)

  - fixed hrDeviceTable with interfaces with large ifIndex     (#1195547)

  - added 'diskio' option to snmpd.conf, it's possible to     monitor only selected devices in diskIOTable (#990674)

  - fixed CVE-2014-2284: denial of service flaw in Linux     implementation of ICMP-MIB (#1073223)

  - added cache to hrSWRunTable to provide consistent     results (#1007634)

  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is     enabled (#1073237)

  - fixed snmptrapd crashing on forwarding SNMPv3 traps     (#1131844)

  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)

  - fixed snmp daemons and utilities crashing in FIPS mode     (#1001830)

  - added support of btrfs filesystem in hrStorageTable     (#1006706)

  - fixed issues found by static analysis tools

  - restored ABI of read_configs_* functions

  - fixed parsing of bulk responses (#983116)

  - added support of vzfs filesystem in hrStorageTable     (#989498)

  - fixed endless loop when parsing sendmail configuration     file with queue groups (#991213)

  - fixed potential memory leak on realloc failure when     processing 'extend' option (#893119)

  - added precise enumeration of configuration files     searched to snmp_config(5) man page (#907571)

  - set permissions of snmpd.conf and snmptrapd conf to 0600     (#919239)

  - fixed kernel threads in hrSWRunTable (#919952)

  - fixed various error codes in Python module (#955771)

  - fixed snmpd crashing in the middle of agentx request     processing when a subagent disconnects (#955511)

  - allow 'includeFile' and 'includeDir' options in     configuration files (#917816)

  - fixed netlink message size (#927474)

  - fixed IF-MIB::ifSpeedHi on systems with non-standard     interface speeds (#947973)

  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the     bridge itself as a port (#960568)

  - fixed snmpd segfault when 'agentaddress' configuration     options is used and too many SIGHUP signals are received     (#968898)

  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove     disks if 'includeAllDisks' is specified in snmpd.conf     (#922691)

  - fixed crash when parsing invalid SNMP packets (#953926)

  - fixed snmpd crashing with 'exec' command with no     arguments in snmpd.conf (#919259)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add Oracle Linux distribution in platform.py [orabug     21288328] (Keshav Sharma)

  - Enable use of deepcopy with instance methods Resolves:
    rhbz#1223037

  - Since -libs now provide python-ordered dict, added     ordereddict dist-info to site-packages Resolves:
    rhbz#1199997

  - Fix CVE-2014-7185/4650/1912 (CVE-2013-1752) Resolves:
    rhbz#1206572

  - Fix logging module error when multiprocessing module is     not initialized Resolves: rhbz#1204966

  - Add provides for python-ordereddict Resolves:
    rhbz#1199997

  - Let ConfigParse handle options without values

  - Add check phase to specfile, fix and skip relevant     failing tests Resolves: rhbz#1031709

  - Make Popen.communicate catch EINTR error Resolves:
    rhbz#1073165

  - Add choices for sort option of cProfile for better     output Resolves: rhbz#1160640

  - Make multiprocessing ignore EINTR Resolves: rhbz#1180864

  - Fix iteration over files with very long lines Resolves:
    rhbz#794632

  - Fix subprocess.Popen.communicate being broken by SIGCHLD     handler. Resolves: rhbz#1065537

  - Rebuild against latest valgrind-devel. Resolves:
    rhbz#1142170

  - Bump release up to ensure proper upgrade path. Related:
    rhbz#958256

  - Fix multilib dependencies. Resolves: rhbz#958256

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update doc/redhat.gif in tarball

  - Add libxml2-oracle-enterprise.patch and update logos in     tarball

  - CVE-2015-1819 Enforce the reader to run in constant     memory(rhbz#1214163)

  - Stop parsing on entities boundaries errors

  - Fix missing entities after CVE-2014-3660 fix     (rhbz#1149086)

  - CVE-2014-3660 denial of service via recursive entity     expansion (rhbz#1149086)

  - Fix html serialization error and htmlSetMetaEncoding     (rhbz#1004513)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0096 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - ide: Clear DRQ after handling all expected accesses This     is additional hardening against an end_transfer_func     that fails to clear the DRQ status bit. The bit must be     unset as soon as the PIO transfer has completed, so it's     better to do this in a central place instead of     duplicating the code in all commands (and forgetting it     in some).

    This is XSA-138 CVE-2015-5154 (CVE-2015-5154)

  - ide/atapi: Fix START STOP UNIT command completion The     command must be completed on all code paths. START STOP     UNIT with pwrcnd set should succeed without doing     anything.

    This is XSA-138 CVE-2015-5154 (CVE-2015-5154)

  - ide: Check array bounds before writing to io_buffer     (CVE-2015-5154) If the end_transfer_func of a command is     called because enough data has been read or written for     the current PIO transfer, and it fails to correctly call     the command completion functions, the DRQ bit in the     status register and s->end_transfer_func may remain set.
    This allows the guest to access further bytes in     s->io_buffer beyond s->data_end, and eventually     overflowing the io_buffer. One case where this currently     happens is emulation of the ATAPI command START STOP     UNIT. This patch fixes the problem by adding explicit     array bounds checks before accessing the buffer instead     of relying on end_transfer_func to function correctly.
    Cc :

    This is XSA-138 (CVE-2015-5154)

  - ide: Clear DRQ after handling all expected accesses This     is additional hardening against an end_transfer_func     that fails to clear the DRQ status bit. The bit must be     unset as soon as the PIO transfer has completed, so it's     better to do this in a central place instead of     duplicating the code in all commands (and forgetting it     in some).

    This is XSA-138 (CVE-2015-5154)

  - ide: Check array bounds before writing to io_buffer If     the end_transfer_func of a command is called because     enough data has been read or written for the current PIO     transfer, and it fails to correctly call the command     completion functions, the DRQ bit in the status register     and s->end_transfer_func may remain set. This allows the     guest to access further bytes in s->io_buffer beyond     s->data_end, and eventually overflowing the io_buffer.
    One case where this currently happens is emulation of     the ATAPI command START STOP UNIT. This patch fixes the     problem by adding explicit array bounds checks before     accessing the buffer instead of relying on     end_transfer_func to function correctly. Cc :

    This is XSA-138 (CVE-2015-5154)

  - tools: libxl: Explicitly disable graphics backends on     qemu cmdline By default qemu will try to create some     sort of backend for the emulated VGA device, either SDL     or VNC. However when the user specifies sdl=0 and vnc=0     in their configuration libxl was not explicitly     disabling either backend, which could lead to one     unexpectedly running. If either sdl=1 or vnc=1 is     configured then both before and after this change only     the backends which are explicitly enabled are     configured, i.e. this issue only occurs when all     backends are supposed to have been disabled. This     affects qemu-xen and qemu-xen-traditional differently.
    If qemu-xen was compiled with SDL support then this     would result in an SDL window being opened if $DISPLAY     is valid, or a failure to start the guest if not.
    Passing '-display none' to qemu before any further

    -sdl options disables this default behaviour and ensures     that SDL is only started if the libxl configuration     demands it. If qemu-xen was compiled without SDL support     then qemu would instead start a VNC server listening on     ::1 (IPv6 localhost) or 127.0.0.1 (IPv4 localhost) with     IPv6 preferred if available. Explicitly pass '-vnc none'     when vnc is not enabled in the libxl configuration to     remove this possibility. qemu-xen-traditional would     never start a vnc backend unless asked. However by     default it will start an SDL backend, the way to disable     this is to pass a -vnc option. In other words passing     '-vnc none' will disable both vnc and sdl by default.
    sdl can then be reenabled if configured by subsequent     use of the -sdl option. Tested with both qemu-xen and     qemu-xen-traditional built with SDL support and: xl cr #     defaults xl cr sdl=0 vnc=0 xl cr sdl=1 vnc=0 xl cr sdl=0     vnc=1 xl cr sdl=0 vnc=0 vga='none' xl cr sdl=0 vnc=0     nographic=1 with both valid and invalid $DISPLAY. This     is XSA-119 / CVE-2015-2152. (CVE-2015-2152)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - ipv6: Don't reduce hop limit for an interface (D.S.
    Ljungmark) [Orabug: 21444790] (CVE-2015-2922)

  - ipv4: Missing sk_nulls_node_init in ping_unhash. (David     S. Miller) [Orabug: 21444687] (CVE-2015-3636)

The remote OracleVM system is missing necessary patches to address critical security updates :

nss

  - Added nss-vendor.patch to change vendor

  - Additional NULL initialization.

  - Updated the patch to keep old cipher suite order

  - Resolves: Bug 1224449

  - Rebase to nss-3.19.1

  - Resolves: Bug 1224449

  - On RHEL 6.x keep the TLS version defaults unchanged.

  - Relax the requirement from pkcs11-devel to     nss-softokn-freebl-devel to allow same or newer.

  - Require softokn build 22 to ensure runtime     compatibility.

  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in     NSS 3.18.1)

  - Update and reeneable nss-646045.patch on account of the     rebase

  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL7.1]

  - Fix shell syntax error in nss/tests/all.sh

  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-6.6]

  - Restore a patch that had been mistakenly disabled

  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-6.6]

  - Replace expired PayPal test certificate that breaks the     build

  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-6.6]

  - Rebase to NSS 3.18

  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-6.6]

  - Keep the same cipher suite order as we had in     NSS_3_15_3_RTM

  - Resolves: Bug 1202488 - openldap-2.4.23-34.el6_5.1.i686     fails after updating nss to nss-3.16.1-4.el6_5.i686

  - Resolves: Bug 1182902 - rhel65 ns-slapd crash, segfault     error 4 in libnss3.so in PK11_DoesMechanism at     pk11slot.c:1824

nss-util

  - Rebase to nss-3.19.1

  - Resolves: Bug 1224449

  - Resolves: - Bug 1205064 - [RHEL6.6] nss-util 3.18 rebase     required for firefox 38 ESR

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/asm/entry/64: Remove a bogus 'ret_from_fork'     optimization (Andy Lutomirski) [Orabug: 21308309]     (CVE-2015-2830)

  - x86, mm/ASLR: Fix stack randomization on 64-bit systems     (Hector Marco-Gisbert) [Orabug: 21307919]     (CVE-2015-1593) (CVE-2015-1593)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-1158, CVE-2015-1159, CVE-2014-9679 (bug     #1229982).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - improved fix for (CVE-2015-1791)

  - add missing parts of CVE-2015-0209 fix for corectness     although unexploitable

  - fix CVE-2014-8176 - invalid free in DTLS buffering code

  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time

  - fix CVE-2015-1790 - PKCS7 crash with missing     EncryptedContent

  - fix CVE-2015-1791 - race condition handling     NewSessionTicket

  - fix CVE-2015-1792 - CMS verify infinite loop with     unknown hash function

  - fix CVE-2015-3216 - regression in RAND locking that can     cause segfaults on read in multithreaded applications

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86_64, vdso: Fix the vdso address randomization     algorithm (Andy Lutomirski) [Orabug: 21226729]     (CVE-2014-9585)

  - isofs: Fix infinite looping over CE entries (Jan Kara)     [Orabug: 21225975] (CVE-2014-9420)

  - x86_64, switch_to: Load TLS descriptors before switching     DS and ES (Andy Lutomirski) [Orabug: 21225937]     (CVE-2014-9419)

  - xen-netfront: use correct linear area after linearizing     an skb (David Vrabel) [Orabug: 21209908] - sched:
    Prevent divide by zero when cpu power calculation is 0     (Todd Vierling) [Orabug: 21123125]

ID	Name	Severity
87803	OracleVM 3.3 : gnutls (OVMSA-2016-0004)	medium
87802	OracleVM 3.3 : nss (OVMSA-2016-0003)	medium
87801	OracleVM 3.3 : rpcbind (OVMSA-2016-0002)	medium
87800	OracleVM 3.3 : openssl (OVMSA-2016-0001) (SLOTH)	high
87489	OracleVM 3.3 : bind (OVMSA-2015-0156)	medium
87366	OracleVM 3.3 : openssl (OVMSA-2015-0155)	high
87333	OracleVM 3.3 : kernel-uek (OVMSA-2015-0154)	medium
87303	OracleVM 3.3 : libpng (OVMSA-2015-0153)	high
87273	OracleVM 2.2 : xen (OVMSA-2015-0151)	high
87232	OracleVM 3.3 : libxml2 (OVMSA-2015-0152)	high
87167	OracleVM 3.3 : kernel-uek (OVMSA-2015-0150)	medium
86882	OracleVM 3.3 : kernel-uek (OVMSA-2015-0147)	high
86802	OracleVM 3.2 : xen (OVMSA-2015-0143)	high
86782	OracleVM 3.3 : nss / nss-util,nspr (OVMSA-2015-0145)	critical
86781	OracleVM 3.3 : kernel-uek (OVMSA-2015-0144)	medium
86670	OracleVM 3.2 : xen (OVMSA-2015-0142)	high
86669	OracleVM 3.3 : xen (OVMSA-2015-0141)	high
86613	OracleVM 3.3 : ntp (OVMSA-2015-0140)	high
86216	OracleVM 3.3 : openldap (OVMSA-2015-0123)	medium
85968	OracleVM 3.3 : kernel-uek (OVMSA-2015-0122)	medium
85784	OracleVM 3.3 : libXfont (OVMSA-2015-0120)	high
85783	OracleVM 3.3 : bind (OVMSA-2015-0119)	high
85733	OracleVM 3.3 : nss-softokn (OVMSA-2015-0118)	medium
85529	OracleVM 3.3 : pam (OVMSA-2015-0117)	medium
85528	OracleVM 3.3 : net-snmp (OVMSA-2015-0116)	medium
85527	OracleVM 3.3 : sqlite (OVMSA-2015-0115)	high
85493	OracleVM 3.3 : kernel-uek (OVMSA-2015-0114)	high
85340	OracleVM 3.3 : kernel-uek (OVMSA-2015-0113)	low
85237	OracleVM 3.2 : xen (OVMSA-2015-0112)	medium
85236	OracleVM 3.3 : xen (OVMSA-2015-0111)	high
85188	OracleVM 3.3 : kernel-uek (OVMSA-2015-0109)	critical
85148	OracleVM 3.3 : curl (OVMSA-2015-0107)	medium
85147	OracleVM 3.3 : libuser (OVMSA-2015-0106)	high
85146	OracleVM 3.3 : bind (OVMSA-2015-0105)	high
85145	OracleVM 3.3 : kernel-uek (OVMSA-2015-0104)	medium
85144	OracleVM 3.3 : sudo (OVMSA-2015-0103)	low
85143	OracleVM 3.3 : ntp (OVMSA-2015-0102)	high
85142	OracleVM 3.3 : gnutls (OVMSA-2015-0101)	high
85141	OracleVM 3.3 : grep (OVMSA-2015-0100)	high
85140	OracleVM 3.3 : net-snmp (OVMSA-2015-0099)	medium
85139	OracleVM 3.3 : python (OVMSA-2015-0098)	medium
85138	OracleVM 3.3 : libxml2 (OVMSA-2015-0097)	medium
85038	OracleVM 3.2 : xen (OVMSA-2015-0096)	high
85037	OracleVM 3.3 : xen (OVMSA-2015-0095)	high
84891	OracleVM 3.3 : kernel-uek (OVMSA-2015-0094)	medium
84440	OracleVM 3.3 : nss (OVMSA-2015-0073)	medium
84390	OracleVM 3.3 : kernel-uek (OVMSA-2015-0072)	medium
84257	OracleVM 3.3 : cups (OVMSA-2015-0071)	critical
84203	OracleVM 3.3 : openssl (OVMSA-2015-0070)	high
84141	OracleVM 3.3 : kernel-uek (OVMSA-2015-0069)	medium

Detections

Analytics

OracleVM Local Security Checks Family for Nessus

medium

medium

medium

high

medium

high

medium

high

high

high

medium

high

high

critical

medium

high

high

high

medium

medium

high

high

medium

medium

medium

high

high

low

medium

high

critical

medium

high

high

medium

low

high

high

high

medium

medium

medium

high

high

medium

medium

medium

critical

high

medium