Red Hat Security AdvisoryRHSA-2016:0594
graphite2 security, bug fix, and enhancement update
Released 2016-04-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) graphite2-1.3.6-1.el7_2
- Red Hat Enterprise Linux Client Optional (v. 7) graphite2-devel-1.3.6-1.el7_2
- Red Hat Enterprise Linux ComputeNode (v. 7) graphite2-1.3.6-1.el7_2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) graphite2-devel-1.3.6-1.el7_2
- Red Hat Enterprise Linux Server (v. 7) graphite2-1.3.6-1.el7_2, graphite2-1.3.6-1.el7_2.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) graphite2-devel-1.3.6-1.el7_2, graphite2-devel-1.3.6-1.el7_2.ppc
- Red Hat Enterprise Linux Workstation (v. 7) graphite2-1.3.6-1.el7_2
- Red Hat Enterprise Linux Workstation Optional (v. 7) graphite2-devel-1.3.6-1.el7_2
Fixes 4 records
Priority MEDIUM 49
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0831 · Published 2016-02-13 · Fixed CWE-119
Priority MEDIUM 45
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote a…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.04065 · Published 2016-02-13 · Fixed CWE-119
Priority MEDIUM 40
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attack…
CVSS 3.0HIGH 8.1· Network · No auth · User interaction · EPSS 0.02254 · Published 2016-02-13 · Fixed CWE-119
Priority LOW 33
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to…
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02318 · Published 2016-02-13 · Fixed
THREATIST.IORead the docs