Weekly Vulnerabilities Reports > May 18 to 24, 2015

Overview

2 new vulnerabilities reported during this period, including 0 critical vulnerabilities and 1 high severity vulnerabilities. This weekly summary report vulnerabilities in 27 products from 14 vendors including Apple, Debian, Google, IBM, and Oracle. Vulnerabilities are notably categorized as "Link Following", and "Cryptographic Issues".

  • 1 reported vulnerabilities are remotely exploitables.
  • 1 reported vulnerabilities are exploitable by an anonymous user.
  • Apple has the most reported vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

0 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS

1 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2015-05-18 CVE-2015-3629 Docker
Opensuse 		Link Following vulnerability in multiple products

Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
7.8

0 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS

1 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2015-05-21 CVE-2015-4000 Openssl
Canonical
HP
IBM
Oracle
Debian
Suse
Apple
Mozilla
Opera
Microsoft
Google 		Cryptographic Issues vulnerability in multiple products

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
3.7