JVN Info.

Id
20357  
Name
JVNDB-2013-001932  
Title
IBM Sterling Order Management における XPath インジェクション攻撃を実行される脆弱性  
Summary
IBM Sterling Order Management には、XPath インジェクション攻撃を実行される、および任意の XML ファイルを読まれる脆弱性が存在します。  
Nvdinfo
CVE-2013-0505  
Cvssv2
5.5  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001932.html  
Published Date
2013-03-18  
Registered Date
2013-03-22  
Last Updated Date
2013-03-22  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
54340 nessus-scan-192-168-10-10#20170210#1.csv 20357 93542 CVE-2016-4809 5 Medium 192.168.10.10 tcp 0 CentOS 6 : libarchive (CESA-2016:1850) The remote CentOS host is missing one or more security updates. An update for libarchive is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es) : * A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive"s file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418) * Multiple out-of-bounds read flaws were found in libarchive. Specially crafted AR or MTREE files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8920, CVE-2015-8921) * A denial of service vulnerability was found in libarchive"s handling of GZIP streams. A crafted GZIP file could cause libarchive to allocate an excessive amount of memory, eventually leading to a crash. (CVE-2016-7166) * A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809) * Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted Compress streams or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8932, CVE-2016-5844) Red Hat would like to thank Insomnia Security for reporting CVE-2016-5418. Update the affected libarchive packages. http://www.nessus.org/u?b0e5dbfd Remote package installed : libarchive-2.8.3-4.el6_2 Should be : libarchive-2.8.3-7.el6_8