Test ID:	1.3.6.1.4.1.25623.1.0.122787
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2015-2199)
Summary:	The remote host is missing an update for the 'glibc' package(s) announced via the ELSA-2015-2199 advisory.
Description:	Summary: The remote host is missing an update for the 'glibc' package(s) announced via the ELSA-2015-2199 advisory. Vulnerability Insight: [2.17-105.0.1] - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. [2.17-105] - Fix up test case for initial-exec fix (#1248208). [2.17-104] - Mark all TLS variables in libc.so as initial-exec (#1248208). [2.17-103] - Apply correct fix for #1195672. [2.17-102] - Remove workaround for kernel netlink bug (#1089836). - Use only 32-bit instructions in optimized 32-bit POWER functions (#1240796). [2.17-101] - Correct the AArch64 ABI baseline for libpthread (#1234622). [2.17-100] - Prevent tst-rec-dlopen from intermittently failing in parallel builds due to a missing makefile dependency (#1225959). [2.17-99] - Increase AArch64 TLS descriptor performance (#1202952). [2.17-98] - Move arch-specific header files from glibc-headers to glibc-devel (#1230328). [2.17-97] - Rebase high-precision timing support for microbenchmark (#1214326). [2.17-96] - Rebase microbenchmarks from upstream for performance testing (#1214326) - Fix running microbenchmark script bench.pl from source (#1084395) [2.17-95] - Enable systemtap support for all architectures (#1225490). [2.17-94] - Fix ruserok API scalability issues (#1216246). [2.17-93] - Backport fixes and enhancements for ppc64 and ppc64le (#1162895). - Correct DT_PPC64_NUM in elf/elf.h. - Correct IBM long double frexpl. - Correct IBM long double nextafterl. [2.17-92] - Backport fixes for various security flaws (#1209107): - Prevent heap buffer overflow in swscanf (CVE-2015-1472, CVE-2015-1473, - Prevent integer overflow in _IO_wstr_overflow (#1195762). - Prevent potential denial of service in internal_fnmatch (#1197730). - Prevent buffer overflow in gethostbyname_r and related functions with misaligned buffer (CVE-2015-1781, #1199525). [2.17-91] - Allow more shared libraries with static TLS to be loaded (#1227699). [2.17-90] - Work around kernel netlink bug on some specialized hardware setup (#1089836). - Fix invalid file descriptor reuse when sending DNS query (CVE-2013-7423, #1194143). - Sync netinet/tcp.h with the kernel (#1219891). [2.17-89] - Avoid deadlock in malloc on backtrace (#1207032). - Actually test iconv modules (#1176906). - Use calloc to allocate xports (#1159169). - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN (#1098042). [2.17-88] - Add librtkaio.abilist generated by make update-abi (#1173238). [2.18-87] - Enhance nscd inotify support (#1193797). [2.17-86] - Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (#1173537). [2.17-85] - Skip logging for DNSSEC responses (#1186620). - Also apply the RHEL6.7 Makerules patch (#1189278). [2.17-84] - Initialize nscd stats data (#1183456). [2.17-83] - Resize DTV if the current DTV isn't big enough (#1189278). [2.17-82] - Backport an alternate implementation of strstr and strcasestr for x86 that ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'glibc' package(s) on Oracle Linux 7. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-7423 BugTraq ID: 72844 http://www.securityfocus.com/bid/72844 http://seclists.org/fulldisclosure/2021/Sep/0 https://security.gentoo.org/glsa/201602-02 http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html http://www.openwall.com/lists/oss-security/2015/01/28/20 RedHat Security Advisories: RHSA-2015:0863 http://rhn.redhat.com/errata/RHSA-2015-0863.html RedHat Security Advisories: RHSA-2016:1207 https://access.redhat.com/errata/RHSA-2016:1207 SuSE Security Announcement: openSUSE-SU-2015:0351 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html http://www.ubuntu.com/usn/USN-2519-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-1472 BugTraq ID: 72428 http://www.securityfocus.com/bid/72428 Bugtraq: 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series (Google Search) https://seclists.org/bugtraq/2019/Jun/14 Bugtraq: 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X (Google Search) https://seclists.org/bugtraq/2019/Sep/7 http://seclists.org/fulldisclosure/2019/Jun/18 http://seclists.org/fulldisclosure/2019/Sep/7 http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html https://sourceware.org/ml/libc-alpha/2015-02/msg00119.html http://openwall.com/lists/oss-security/2015/02/04/1 Common Vulnerability Exposure (CVE) ID: CVE-2015-1473 BugTraq ID: 72499 http://www.securityfocus.com/bid/72499 Common Vulnerability Exposure (CVE) ID: CVE-2015-1781 1032178 http://www.securitytracker.com/id/1032178 74255 http://www.securityfocus.com/bid/74255 DSA-3480 http://www.debian.org/security/2016/dsa-3480 FEDORA-2016-0480defc94 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html GLSA-201602-02 RHSA-2015:0863 https://rhn.redhat.com/errata/RHSA-2015-0863.html SUSE-SU-2015:1424 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html SUSE-SU-2016:0470 http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html USN-2985-1 http://www.ubuntu.com/usn/USN-2985-1 USN-2985-2 http://www.ubuntu.com/usn/USN-2985-2 [libc-alpha] 20150814 The GNU C Library version 2.22 is now available https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html https://sourceware.org/bugzilla/show_bug.cgi?id=18287 https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=2959eda9272a03386
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.