From Red Hat Security Advisory 2019:0778 :

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

* OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0775 :

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

* OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

* OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0774 :

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)

* OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

* OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* assert failure in coalesce.cpp: attempted to spill a non-spillable item (BZ #1640127)

From Red Hat Security Advisory 2019:0766 :

An update for mod_auth_mellon is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The mod_auth_mellon module for the Apache HTTP Server is an authentication service that implements the SAML 2.0 federation protocol. The module grants access based on the attributes received in assertions generated by an IdP server.

Security Fix(es) :

* mod_auth_mellon: authentication bypass in ECP flow (CVE-2019-3878)

* mod_auth_mellon: open redirect in logout url when using URLs with backslashes (CVE-2019-3877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* mod_auth_mellon Cert files name wrong when hostname contains a number (fixed in upstream package) (BZ#1697487)

Description of changes:

[4.14.35-1844.4.5.el7uek]
- x86/apic/x2apic: set back affinity of a single interrupt to one cpu (Mridula Shastry)  [Orabug: 29510342]

[4.14.35-1844.4.4.el7uek]
- ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner)  [Orabug: 29598590]
- swiotlb: checking whether swiotlb buffer is full with io_tlb_used (Dongli Zhang)  [Orabug: 29587097]
- swiotlb: add debugfs to track swiotlb buffer usage (Dongli Zhang)  [Orabug: 29587097]
- swiotlb: fix comment on swiotlb_bounce() (Dongli Zhang)  [Orabug: 29587097]
- scsi: target: add device product id and revision configfs attributes (Alan Adamson)  [Orabug: 29344881]
- scsi: target: remove hardcoded T10 Vendor ID in INQUIRY response (David Disseldorp)  [Orabug: 29344881]
- scsi: target: add device vendor_id configfs attribute (David Disseldorp)  [Orabug: 29344881]
- scsi: target: consistently null-terminate t10_wwn strings (David Disseldorp)  [Orabug: 29344881]
- scsi: target: use consistent left-aligned ASCII INQUIRY data (David Disseldorp)  [Orabug: 29344881]
- x86/speculation: Keep enhanced IBRS on when prctl is used for SSBD control (Alejandro Jimenez)  [Orabug: 29526400]
- drm/amdkfd: fix amdkfd use-after-free GP fault (Randy Dunlap)  [Orabug: 29534199]

[4.14.35-1844.4.3.el7uek]
- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp)  [Orabug: 29215297]  {CVE-2019-3701} {CVE-2019-3701}

[4.14.35-1844.4.2.el7uek]
- x86/speculation: Clean up enhanced IBRS checks in bugs.c (Alejandro Jimenez)  [Orabug: 29423796]
- x86/speculation: Keep enhanced IBRS on when spec_store_bypass_disable=on is used (Alejandro Jimenez)  [Orabug: 29423796]
- kvm/speculation: Allow KVM guests to use SSBD even if host does not (Alejandro Jimenez)  [Orabug: 29423796]
- exec: Fix mem leak in kernel_read_file (YueHaibing)  [Orabug: 29454858]  {CVE-2019-8980}
- net: crypto set sk to NULL when af_alg_release. (Mao Wenan)  [Orabug: 29454874]  {CVE-2019-8912}
- {net, IB}/mlx5: Raise fatal IB event when sys error occurs (Daniel Jurgens)  [Orabug: 29479744]
- net/mlx5e: Avoid query PPCNT register if not supported by the device (Eyal Davidovich)  [Orabug: 29479795]
- mm: enforce min addr even if capable() in expand_downwards() (Jann Horn)  [Orabug: 29501977]  {CVE-2019-9213}
- [UEK-5] IB/mlx5_core: Use kzalloc when allocating PD (Erez Alfasi)  [Orabug: 29479806]
- IB/mlx5: Change debugfs to have per port contents (Parav Pandit)  [Orabug: 29486784]
- Revert 'IB/mlx5: Change debugfs to have per port contents' (Qing Huang)  [Orabug: 29486784]
- scsi: scsi_transport_iscsi: modify detected conn err to KERN_ERR (Fred Herard)  [Orabug: 29487789]
- xen/blkfront: avoid NULL blkfront_info dereference on device removal (Vasilis Liaskovitis)  [Orabug: 29489795]
- qlcnic: fix Tx descriptor corruption on 82xx devices (Shahed Shaikh)  [Orabug: 29495427]

[4.14.35-1844.4.1.el7uek]
- scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task (Anoob Soman)  [Orabug: 29024514]
- scsi: scsi_transport_iscsi: redirect conn error to console (Fred Herard)  [Orabug: 29469713]
- Revert x86/apic/x2apic: set affinity of a single interrupt to one cpu (Mridula Shastry)  [Orabug: 29469651]
- net/mlx5: Fix error handling in load one (Maor Gottlieb)  [Orabug: 29019396]
- net/mlx5: Fix mlx5_get_uars_page to return error code (Eran Ben Elisha)  [Orabug: 29019396]
- net/mlx5: Fix memory leak in bad flow of mlx5_alloc_irq_vectors (Alaa Hleihel)  [Orabug: 29019396]
- net/mlx4_core: Fix wrong calculation of free counters (Eran Ben Elisha)  [Orabug: 29019396]
- net/mlx5: Free IRQs in shutdown path (Daniel Jurgens)  [Orabug: 29019427]
- net/mlx5e: DCBNL fix min inline header size for dscp (Huy Nguyen)  [Orabug: 29019427]
- IB/mlx4: Fix integer overflow when calculating optimal MTT size (Jack Morgenstein)  [Orabug: 29019427]
- net/mlx5: Fix mlx5_get_vector_affinity function (Israel Rukshin)  [Orabug: 29019427]
- net/mlx5e: Fixed sleeping inside atomic context (Aviad Yehezkel)  [Orabug: 29019427]
- IB/core: Generate GID change event regardless of RoCE GID table property (Parav Pandit)  [Orabug: 29019427]
- net/mlx5: Vport, Use 'kvfree()' for memory allocated by 'kvzalloc()' (Christophe JAILLET)  [Orabug: 29019430]
- IB/mlx4: Use 4K pages for kernel QP's WQE buffer (Jack Morgenstein)  [Orabug: 29019795]
- net/mlx5: Add missing SET_DRIVER_VERSION command translation (Noa Osherovich)  [Orabug: 29447325]
- net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables (Raed Salem)  [Orabug: 29447325]
- net/mlx5: Fix debugfs cleanup in the device init/remove flow (Jack Morgenstein)  [Orabug: 29447325]
- net/mlx5: Check for error in mlx5_attach_interface (Huy Nguyen)  [Orabug: 29447325]
- net/mlx5: Fix use-after-free in self-healing flow (Jack Morgenstein)  [Orabug: 29447325]
- uek-rpm: update list of removed files, generated by depmod on install stage (Alexander Burmashev)  [Orabug: 29460369]

[4.14.35-1844.4.0.el7uek]
- fs/dcache.c: add cond_resched() in shrink_dentry_list() (Nikolay Borisov)  [Orabug: 29450975]
- net_failover: delay taking over primary device to accommodate udevd renaming (Si-Wei Liu)
- hugetlbfs: fix races and page leaks during migration (Mike Kravetz)  [Orabug: 29443877]
- rds: update correct congestion map for loopback transport (Mukesh Kacker)  [Orabug: 29431289]
- KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier)  [Orabug: 29408638]  {CVE-2019-7221}
- KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini)  [Orabug: 29408618]  {CVE-2019-7222}
- kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn)  [Orabug: 29408541]  {CVE-2019-6974}
- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh Kacker)  [Orabug: 29384900]
- bnxt_en: Return linux standard errors in bnxt_ethtool.c (Vasundhara Volam)  [Orabug: 29261957]
- bnxt_en: Don't set ETS on unused TCs. (Michael Chan)  [Orabug: 29261957]
- bnxt_en: get the reduced max_irqs by the ones used by RDMA (Vasundhara Volam)  [Orabug: 29261957]
- bnxt_en: free hwrm resources, if driver probe fails. (Venkat Duvvuru)  [Orabug: 29261957]
- bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request (Vasundhara Volam)  [Orabug: 29261957]
- bnxt_en: Fix VNIC reservations on the PF. (Michael Chan)  [Orabug: 29261957]

From Red Hat Security Advisory 2019:0717 :

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members (CVE-2018-13405)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* sched/sysctl: Check user input value of sysctl_sched_time_avg (BZ#1579128)

* unable to handle kernel NULL pointer dereference at 000000000000005d in tcp_enter_frto+0x102 (BZ#1585892)

* qla2xxx: Mask Off Scope bits for Retry delay timer in the driver (BZ# 1588133)

* [PATCH] perf: Fix a race between ring_buffer_detach() and ring_buffer_wakeup() (BZ#1589340)

* RHEL6.10 - kernel: improve spectre mitigation for s390x (BZ#1625381)

* kernel panic due to NULL pointer dereference in __wake_up_common through perf_event_wakeup (BZ#1627672)

* After upgrading from rhel 6.9 to rhel 6.10, files in a cifs share can't be read (BZ#1636484)

* Retpoline impact on vdso gettimeofday performance (BZ#1638552)

* [RHEL 6.10] 32-bit kernel-2.6.32-754.3.5 registers the swap of 4k size only (BZ#1670328)

From Red Hat Security Advisory 2019:0711 :

An update for openssh is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es) :

* openssh: User enumeration via malformed packets in authentication requests (CVE-2018-15473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[2.6.39-400.308.1.el6uek]
- x86/fpu: Fix 32-bit signal frame handling (Dave Hansen) [Orabug: 28874707]
- x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg Nesterov) [Orabug: 28874707]
- x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg Nesterov) [Orabug: 28874707]
- x86/fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Oleg Nesterov) [Orabug: 28874707]
- x86/fpu: Don't reset thread.fpu_counter (Oleg Nesterov) [Orabug: 28874707]
- x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() (Oleg Nesterov) [Orabug: 28874707]
- x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Oleg Nesterov) [Orabug: 28874707]
- x86, fpu: Introduce per-cpu in_kernel_fpu state (Oleg Nesterov) [Orabug: 28874707]
- x86, fpu: Check tsk_used_math() in kernel_fpu_end() for eager FPU (Suresh Siddha) [Orabug: 28874707]
- x86: Allow FPU to be used at interrupt time even with eagerfpu (Pekka Riikonen) [Orabug: 28874707]
- ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Ts'o) [Orabug: 29396714] {CVE-2018-10877} {CVE-2018-10877}
- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: 29545568] {CVE-2018-10882} {CVE-2018-10882}

Description of changes:

kernel-uek [3.8.13-118.32.1.el7uek]
- x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg Nesterov) [Orabug: 29012034]
- x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg Nesterov) [Orabug: 29012034]
- x86/fpu: Fix 32-bit signal frame handling (Dave Hansen) [Orabug: 29012034]
- x86/fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Oleg Nesterov) [Orabug: 29012034]
- x86/fpu: Don't reset fpu_counter (Oleg Nesterov) [Orabug: 29012034]
- x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() (Oleg Nesterov) [Orabug: 29012034]
- x86, fpu: Introduce per-cpu in_kernel_fpu state (Oleg Nesterov) [Orabug: 29012034]
- x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Oleg Nesterov) [Orabug: 29012034]
- x86: Allow FPU to be used at interrupt time even with eagerfpu (Pekka Riikonen) [Orabug: 29012034]
- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215300] {CVE-2019-3701} {CVE-2019-3701}
- ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Ts'o) [Orabug: 29396713] {CVE-2018-10877} {CVE-2018-10877}
- ext4: always verify the magic number in xattr blocks (Theodore Ts'o) [Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}
- ext4: add corruption check in ext4_xattr_set_entry() (Theodore Ts'o) [Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}
- ext4: clear i_data in ext4_inode_info when removing inline data (Theodore Ts'o) [Orabug: 29540710] {CVE-2018-10881} {CVE-2018-10881}
- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: 29545567] {CVE-2018-10882} {CVE-2018-10882}

From Red Hat Security Advisory 2019:0710 :

An update for python is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es) :

* python: Information Disclosure due to urlsplit improper NFKC normalization (CVE-2019-9636)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0697 :

An update for freerdp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es) :

* freerdp: Integer truncation leading to heap-based buffer overflow in update_read_bitmap_update() function (CVE-2018-8786)

* freerdp: Integer overflow leading to heap-based buffer overflow in gdi_Bitmap_Decompress() function (CVE-2018-8787)

* freerdp: Out-of-bounds write in nsc_rle_decode() function (CVE-2018-8788)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[4.1.12-124.26.7.el7uek]
- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh Kacker) [Orabug: 29384815] - Revert 'x86/apic: Make arch_setup_hwirq NUMA node aware' (Brian Maly) [Orabug: 29542185] - qlcnic: fix Tx descriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 27708787] 
- block: Fix a race between blk_cleanup_queue() and timeout handling (Bart Van Assche) [Orabug: 29158186] - can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215299] {CVE-2019-3701} {CVE-2019-3701}
- CIFS: Enable encryption during session setup phase (Pavel Shilovsky) [Orabug: 29338239] {CVE-2018-1066}
- ext4: clear i_data in ext4_inode_info when removing inline data (Theodore Ts'o) [Orabug: 29540709] {CVE-2018-10881} {CVE-2018-10881}
- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: 29545566] {CVE-2018-10882} {CVE-2018-10882}
- Revert 'KVM: nVMX: Eliminate vmcs02 pool' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM: VMX: introduce alloc_loaded_vmcs' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM: VMX: make MSR bitmaps per-VCPU' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM: x86: pass host_initiated to functions that read MSRs' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM/x86: Add IBPB support' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL - reloaded' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM: SVM: Add MSR-based feature support for serializing LFENCE' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'x86/cpufeatures: rename X86_FEATURE_AMD_SSBD to X86_FEATURE_LS_CFG_SSBD' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'x86/bugs: Add AMD's SPEC_CTRL MSR usage' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR' (Boris Ostrovsky) [Orabug: 29542029] - arch: x86: remove unsued SET_IBPB from spec_ctrl.h (Mihai Carabas) [Orabug: 29336760] - x86: cpu: microcode: fix late loading SpectreV2 bugs eval (Mihai Carabas) [Orabug: 29336760] - x86: cpu: microcode: fix late loading SSBD and L1TF bugs eval (Mihai Carabas) [Orabug: 29336760] - x86: cpu: microcode: Re-evaluate bugs in a CPU after microcode loading (Mihai Carabas) [Orabug: 29336760] - x86: cpu: microcode: update flags for all cpus (Mihai Carabas) [Orabug: 29336760]

[4.1.12-124.26.6.el7uek]
- x86/apic: Make arch_setup_hwirq NUMA node aware (Henry Willard) [Orabug: 29292411]

From Red Hat Security Advisory 2019:0681 :

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.6.1.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

* Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

* Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791)

* Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

* Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810)

* Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)

* Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

* Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

* Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

* Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0680 :

An update for thunderbird is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.6.1.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

* Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

* Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791)

* Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

* Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810)

* Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)

* Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

* Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

* Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

* Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0679 :

An update for libssh2 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libssh2 packages provide a library that implements the SSH2 protocol.

Security Fix(es) :

* libssh2: Integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)

* libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)

* libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)

* libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes (CVE-2019-3863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0672 :

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.6.1 ESR.

Security Fix(es) :

* Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810)

* Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0671 :

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.6.1 ESR.

Security Fix(es) :

* Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810)

* Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[4.1.12-124.26.5.el7uek]
- scsi: scsi_transport_iscsi: modify detected conn err to KERN_ERR (Fred Herard)  [Orabug: 29487790]
- xen/blkfront: avoid NULL blkfront_info dereference on device removal (Vasilis Liaskovitis)  [Orabug: 29469740]

[4.1.12-124.26.4U.el7uek]
- bnxt_en: Fix race conditions in .ndo_get_stats64(). (Michael Chan)  [Orabug: 29129625]
- ext4: always verify the magic number in xattr blocks (Theodore Ts'o)  [Orabug: 29437127]  {CVE-2018-10879} {CVE-2018-10879}
- ext4: add corruption check in ext4_xattr_set_entry() (Theodore Ts'o)  [Orabug: 29437127]  {CVE-2018-10879} {CVE-2018-10879}
- net: add netif_is_lag_port helper (Jiri Pirko)  [Orabug: 29495360]
- net: add netif_is_lag_master helper (Jiri Pirko)  [Orabug: 29495360]
- net: add netif_is_team_port helper (Jiri Pirko)  [Orabug: 29495360]
- net: add netif_is_team_master helper (Jiri Pirko)  [Orabug: 29495360]

From Red Hat Security Advisory 2019:0638 :

An update for openwsman is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Openwsman is a project intended to provide an open source implementation of the Web Services Management specification (WS-Management) and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services specifications and usage requirements that cover all system management aspects.

Security Fix(es) :

* openwsman: Disclosure of arbitrary files outside of the registered URIs (CVE-2019-3816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0633 :

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* ghostscript: superexec operator is available (700585) (CVE-2019-3835)

* ghostscript: forceput in DefineResource is still accessible (700576) (CVE-2019-3838)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* ghostscript: Regression: double comment chars '%%' in gs_init.ps leading to missing metadata (BZ#1673915)

From Red Hat Security Advisory 2019:0623 :

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.6.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

* Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

* Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791)

* Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

* Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

* Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

* Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

* Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0622 :

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.6.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

* Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

* Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791)

* Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

* Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

* Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

* Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

* Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0597 :

An update for cloud-init is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es) :

* cloud-init: extra ssh keys added to authorized_keys on the Azure platform (CVE-2019-0816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0512 :

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

* kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks (CVE-2018-17972)

* kernel: Faulty computation of numberic bounds in the BPF verifier (CVE-2018-18445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) and Enhancement(s) :

* kernel fuse invalidates cached attributes during reads (BZ#1657921)

* [NetApp-FC-NVMe] RHEL7.6: nvme reset gets hung indefinitely (BZ#1659937)

* Memory reclaim deadlock calling __sock_create() after memalloc_noio_save() (BZ#1660392)

* hardened usercopy is causing crash (BZ#1660815)

* Backport: xfrm: policy: init locks early (BZ#1660887)

* AWS m5 instance type loses NVMe mounted volumes [was: Unable to Mount StatefulSet PV in AWS EBS] (BZ#1661947)

* RHEL 7.6 running on a VirtualBox guest with a GUI has a mouse problem (BZ# 1662848)

* Kernel bug report in cgroups on heavily contested 3.10 node (BZ#1663114)

* [PCIe] SHPC probe crash on Non-ACPI/Non-SHPC ports (BZ#1663241)

* [Cavium 7.7 Feat] qla2xxx: Update to latest upstream. (BZ#1663508)

* Regression in lpfc and the CNE1000 (BE2 FCoE) adapters that no longer initialize (BZ#1664067)

* [csiostor] call trace after command: modprobe csiostor (BZ#1665370)

* libceph: fall back to sendmsg for slab pages (BZ#1665814)

* Deadlock between stop_one_cpu_nowait() and stop_two_cpus() (BZ#1667328)

* Soft lockups occur when the sd driver passes a device size of 1 sector to string_get_size() (BZ#1667989)

* [RHEL7.7] BUG: unable to handle kernel paging request at ffffffffffffffff (BZ#1668208)

* RHEL7.6 - powerpc/pseries: Disable CPU hotplug across migrations / powerpc/ rtas: Fix a potential race between CPU-Offline & Migration (LPM) (BZ# 1669044)

* blk-mq: fix corruption with direct issue (BZ#1670511)

* [RHEL7][patch] iscsi driver can block reboot/shutdown (BZ#1670680)

* [DELL EMC 7.6 BUG] Unable to create-namespace over Dell NVDIMM-N (BZ# 1671743)

* efi_bgrt_init fails to ioremap error during boot (BZ#1671745)

* Unable to mount a share on kernel- 3.10.0-957.el7. The share can be mounted on kernel-3.10.0-862.14.4.el7 (BZ#1672448)

* System crash with RIP nfs_readpage_async+0x43 -- BUG: unable to handle kernel NULL pointer dereference (BZ#1672510)

Users of kernel are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

From Red Hat Security Advisory 2019:0485 :

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* tomcat: Open redirect in default servlet (CVE-2018-11784)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0483 :

An update for openssl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es) :

* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Perform the RSA signature self-tests with SHA-256 (BZ#1673914)

Description of changes:

[2.6.39-400.307.1.el6uek]
- proc: restrict kernel stack dumps to root (John Donnelly) [Orabug: 29114880] {CVE-2018-17972}
- alarmtimer: Prevent overflow for relative nanosleep (Thomas Gleixner) [Orabug: 29269182] {CVE-2018-13053}
- ext4: only look at the bg_flags field if it is valid (Theodore Ts'o) [Orabug: 29409428] {CVE-2018-10876} {CVE-2018-10876}
- vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags (David Howells) [Orabug: 29409428] {CVE-2018-10876}
- net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch) [Orabug: 29422741] {CVE-2018-9568}

Description of changes:

kernel-uek [3.8.13-118.31.1.el6uek]
- alarmtimer: Prevent overflow for relative nanosleep (Thomas Gleixner) [Orabug: 29269167] {CVE-2018-13053}
- KEYS: Don't permit request_key() to construct a new keyring (David Howells) [Orabug: 29304552] {CVE-2017-17807}
- KEYS: add missing permission check for request_key() destination (Eric Biggers) [Orabug: 29304552] {CVE-2017-17807}
- ext4: only look at the bg_flags field if it is valid (Theodore Ts'o) [Orabug: 29409425] {CVE-2018-10876} {CVE-2018-10876}
- net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch) [Orabug: 29422740] {CVE-2018-9568}
- ext4: make sure bitmaps and the inode table don't overlap with bg descriptors (Theodore Ts'o) [Orabug: 29428608] {CVE-2018-10878}
- ext4: always check block group bounds in ext4_init_block_bitmap() (Theodore Ts'o) [Orabug: 29428608] {CVE-2018-10878}

Description of changes:

[4.1.12-124.26.1.el7uek]
- NFS: commit direct writes even if they fail partially (J. Bruce Fields) [Orabug: 28212440] - rds: update correct congestion map for loopback transport (Mukesh Kacker) [Orabug: 29175685] - ext4: only look at the bg_flags field if it is valid (Theodore Ts'o) [Orabug: 29316684] {CVE-2018-10876} {CVE-2018-10876}
- uek-rpm: Add kernel-uek version to kernel-ueknano provides (Somasundaram Krishnasamy) [Orabug: 29357643] - net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch) [Orabug: 29422739] {CVE-2018-9568}
- ext4: always check block group bounds in ext4_init_block_bitmap() (Theodore Ts'o) [Orabug: 29428607] {CVE-2018-10878}
- ext4: make sure bitmaps and the inode table don't overlap with bg descriptors (Theodore Ts'o) [Orabug: 29428607] {CVE-2018-10878}
- vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags (David Howells) [Orabug: 29428607] {CVE-2018-10878}
- iscsi: Capture iscsi debug messages using tracepoints (Fred Herard) [Orabug: 29429855]

[4.1.12-124.25.4.el7uek]
- KEYS: add missing permission check for request_key() destination (Eric Biggers) [Orabug: 29304551] {CVE-2017-17807}
- KEYS: Don't permit request_key() to construct a new keyring (David Howells) [Orabug: 29304551] {CVE-2017-17807}
- mlx4_ib: Distribute completion vectors when zero is supplied (H&aring kon Bugge) [Orabug: 29318191] - bnxt_en: Fix TX timeout during netpoll. (Michael Chan) [Orabug: 29357977] - bnxt_en: Fix for system hang if request_irq fails (Vikas Gupta) [Orabug: 29357977] - bnxt_en: Fix firmware message delay loop regression. (Michael Chan) [Orabug: 29357977] - bnxt_en: reduce timeout on initial HWRM calls (Andy Gospodarek) [Orabug: 29357977] - bnxt_en: Fix NULL pointer dereference at bnxt_free_irq(). (Michael Chan) [Orabug: 29357977] - bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa(). (Michael Chan) [Orabug: 29357977] - bnxt_en: Do not modify max IRQ count after RDMA driver requests/frees IRQs. (Michael Chan) [Orabug: 29357977] - mm: cleancache: fix corruption on missed inode invalidation (Pavel Tikhomirov) [Orabug: 29364670] {CVE-2018-16862}
- l2tp: fix reading optional fields of L2TPv3 (Jacob Wen) [Orabug: 29368048] - net/packet: fix a race in packet_bind() and packet_notifier() (Eric Dumazet) [Orabug: 29385593] {CVE-2018-18559}
- ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Ts'o) [Orabug: 29396712] {CVE-2018-10877} {CVE-2018-10877}

[4.1.12-124.25.3.el7uek]
- blk-mq: Do not invoke .queue_rq() for a stopped queue (Bart Van Assche) [Orabug: 28766011] - uek-rpm: use multi-threaded xz compression for rpms (Alexander Burmashev) [Orabug: 29323635] - uek-rpm: optimize find-requires usage (Alexander Burmashev) [Orabug: 29323635] - find-debuginfo.sh: backport parallel files procession (Alexander Burmashev) [Orabug: 29323635] - KVM: SVM: Add MSR-based feature support for serializing LFENCE (Tom Lendacky) [Orabug: 29335274]

[4.1.12-124.25.2.el7uek]
- Enable RANDOMIZE_BASE (John Haxby) [Orabug: 29305587] - slub: make 
->cpu_partial unsigned (Alexey Dobriyan) [Orabug: 28620592] - dtrace: support kernels built with RANDOMIZE_BASE (Kris Van Hees) [Orabug: 29204005]

Description of changes:

[4.14.35-1844.3.2.el7uek]
- uek-rpm: Remove hardcoded 'kernel_git_commit' macro from specfile (Victor Erminpour)  [Orabug: 29357695]
- mm: cleancache: fix corruption on missed inode invalidation (Pavel Tikhomirov)  [Orabug: 29364665]  {CVE-2018-16862}
- l2tp: fix reading optional fields of L2TPv3 (Jacob Wen)  [Orabug: 29368046]

[4.14.35-1844.3.1.el7uek]
- x86/speculation: Add support for STIBP always-on preferred mode (Thomas Lendacky)  [Orabug: 29344486]
- x86/speculation: Provide IBPB always command line options (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Add seccomp Spectre v2 user space protection mode (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Enable prctl mode for spectre_v2_user (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Add prctl() control for indirect branch speculation (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Prepare arch_smt_update() for PRCTL mode (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Prevent stale SPEC_CTRL msr content (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Split out TIF update (Thomas Gleixner)  [Orabug: 29344486]
- ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Remove static key ibpb_enabled_key (Anjali Kulkarni)  [Orabug: 29344486]
- x86/speculation: Prepare for conditional IBPB in switch_mm() (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Avoid __switch_to_xtra() calls (Thomas Gleixner)  [Orabug: 29344486]
- x86/process: Consolidate and simplify switch_to_xtra() code (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Prepare for per task indirect branch speculation control (Tim Chen)  [Orabug: 29344486]
- x86/speculation: Add command line control for indirect branch speculation (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Unify conditional spectre v2 print functions (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculataion: Mark command line parser data __initdata (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Mark string arrays const correctly (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Reorder the spec_v2 code (Thomas Gleixner)  [Orabug: 29344486]
- x86/l1tf: Show actual SMT state (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Rework SMT state change (Thomas Gleixner)  [Orabug: 29344486]
- sched/smt: Expose sched_smt_present static key (Thomas Gleixner)  [Orabug: 29344486]
- x86/Kconfig: Select SCHED_SMT if SMP enabled (Thomas Gleixner)  [Orabug: 29344486]
- sched/smt: Make sched_smt_present track topology (Peter Zijlstra (Intel))  [Orabug: 29344486]
- x86/speculation: Reorganize speculation control MSRs update (Tim Chen)  [Orabug: 29344486]
- x86/speculation: Rename SSBD update functions (Thomas Gleixner)  [Orabug: 29344486]
- x86/speculation: Disable STIBP when enhanced IBRS is in use (Tim Chen)  [Orabug: 29344486]
- x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Tim Chen)  [Orabug: 29344486]
- x86/speculation: Remove unnecessary ret variable in cpu_show_common() (Tim Chen)  [Orabug: 29344486]
- x86/speculation: Clean up spectre_v2_parse_cmdline() (Tim Chen)  [Orabug: 29344486]
- x86/speculation: Update the TIF_SSBD comment (Tim Chen)  [Orabug: 29344486]
- sched/core: Fix cpu.max vs. cpuhotplug deadlock (Peter Zijlstra)  [Orabug: 29344486]
- x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Jiri Kosina)  [Orabug: 29344486]
- x86/speculation: Apply IBPB more strictly to avoid cross-process data leak (Jiri Kosina)  [Orabug: 29344486]
- netfilter: nf_tables: deactivate expressions in rule replecement routine (Taehee Yoo)  [Orabug: 29355502]
- btrfs: Verify that every chunk has corresponding block group at mount time (Qu Wenruo)  [Orabug: 29355254]  {CVE-2018-14612}
- mlx4_ib: Distribute completion vectors when zero is supplied (H&aring kon Bugge)  [Orabug: 29324328]
- x86/speculation: Clean up retpoline code in bugs.c (Alejandro Jimenez)  [Orabug: 29211613]
- x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE (WANG Chao)  [Orabug: 29211613]
- x86/build: Fix compiler support check for CONFIG_RETPOLINE (Masahiro Yamada)  [Orabug: 29211613]
- x86/retpoline: Remove minimal retpoline support (Zhenzhong Duan)  [Orabug: 29211613]
- uek-rpm: Enable device-mapper era driver (Dave Aldridge)  [Orabug: 29283140]
- uek-rpm: use multi-threaded xz compression for rpms (Alexander Burmashev)  [Orabug: 29322860]
- uek-rpm: optimize find-requires usage (Alexander Burmashev)  [Orabug: 29322860]
- find-debuginfo.sh: backport parallel files procession (Alexander Burmashev)  [Orabug: 29322860]

[4.14.35-1844.3.0.el7uek]
- xfs: refactor short form directory structure verifier function (Darrick J. Wong)  [Orabug: 29301204]
- xfs: provide a centralized method for verifying inline fork data (Darrick J. Wong)  [Orabug: 29301204]
- xfs: create structure verifier function for short form symlinks (Darrick J. Wong)  [Orabug: 29301204]
- xfs: create structure verifier function for shortform xattrs (Darrick J. Wong)  [Orabug: 29301204]
- btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (Qu Wenruo)  [Orabug: 29301101]  {CVE-2018-14609}
- iommu/amd: Fix IOMMU page flush when detach device from a domain (Suravee Suthikulpanit)  [Orabug: 29297191]
- x86/apic: Switch all APICs to Fixed delivery mode (Thomas Gleixner)  [Orabug: 29262403]
- kvm: x86: Report STIBP on GET_SUPPORTED_CPUID (Eduardo Habkost)  [Orabug: 29229728]
- bnx2x: disable GSO where gso_size is too big for hardware (Daniel Axtens)  [Orabug: 29125104]  {CVE-2018-1000026}
- net: create skb_gso_validate_mac_len() (Daniel Axtens)  [Orabug: 29125104]  {CVE-2018-1000026}
- slub: make ->cpu_partial unsigned (Alexey Dobriyan)  [Orabug: 28973025]

From Red Hat Security Advisory 2019:0482 :

An update for cockpit is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es) :

* cockpit: Crash when parsing invalid base64 headers (CVE-2019-3804)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0464 :

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0462 :

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0436 :

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0435 :

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0420 :

An update for polkit is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.

Security Fix(es) :

* polkit: Temporary auth hijacking via PID reuse and non-atomic fork (CVE-2019-6133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0416 :

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0415 :

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Previously backported upstream patch caused a change in the behavior of page fault handler. As a consequence, applications compiled through GNU Compiler Collection (GCC) version 4.4.7 sometimes generated stack access exceeding the 64K limit. Running such applications subsequently triggered a segmentation fault. With this update, the 64k limit check in the page fault handler has been removed. As a result, running the affected applications no longer triggers the segmentation fault in the described scenario.

Note that removing the limit check does not impact the integrity of the kernel itself. (BZ#1644401)

From Red Hat Security Advisory 2019:0375 :

An update for flatpak is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es) :

* flatpak: potential /proc based sandbox escape (CVE-2019-8308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0374 :

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.5.1 ESR.

Security Fix(es) :

* chromium-browser, mozilla: Use after free in Skia (CVE-2018-18356)

* mozilla: Integer overflow in Skia (CVE-2019-5785)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0373 :

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.5.1 ESR.

Security Fix(es) :

* chromium-browser, mozilla: Use after free in Skia (CVE-2018-18356)

* mozilla: Integer overflow in Skia (CVE-2019-5785)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:0368 :

An update for systemd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es) :

* systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[4.14.35-1844.2.5.el7uek]
- x86/apic: Switch all APICs to Fixed delivery mode (Thomas Gleixner) [Orabug: 29262403]

[4.14.35-1844.2.4.el7uek]
- x86/platform/UV: Add check of TSC state set by UV BIOS (<A HREF='https://oss.oracle.com/mailman/listinfo/el-errata'>mike.travis at hpe.com</A>) [Orabug: 29205471] - x86/tsc: Provide a means to disable TSC ART (<A HREF='https://oss.oracle.com/mailman/listinfo/el-errata'>mike.travis at hpe.com</A>) [Orabug: 29205471] - x86/tsc: Drastically reduce the number of firmware bug warnings (<A HREF='https://oss.oracle.com/mailman/listinfo/el-errata'>mike.travis at hpe.com</A>) [Orabug: 29205471] - x86/tsc: Skip TSC test and error messages if already unstable (<A HREF='https://oss.oracle.com/mailman/listinfo/el-errata'>mike.travis at hpe.com</A>) [Orabug: 29205471] - x86/tsc: Add option that TSC on Socket 0 being non-zero is valid (<A HREF='https://oss.oracle.com/mailman/listinfo/el-errata'>mike.travis at hpe.com</A>) [Orabug: 29205471] - scsi: lpfc: Enable Management features for IF_TYPE=6 (James Smart) [Orabug: 29248376]

[4.14.35-1844.2.3.el7uek]
- RDS: Heap OOB write in rds_message_alloc_sgs() (Mohamed Ghannam) [Orabug: 28983233] - proc: restrict kernel stack dumps to root (Jann Horn) [Orabug: 29114876] {CVE-2018-17972}
- rds: congestion updates can be missed when kernel low on memory (Mukesh Kacker) [Orabug: 29200902] - x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support (Zhenzhong Duan) [Orabug: 29211613] - xen-netback: wake up xenvif_dealloc_kthread when it should stop (Dongli Zhang) [Orabug: 29237355] - xen/blkback: rework validate_io_op() (Dongli Zhang) [Orabug: 29237430] - xen/blkback: optimize validate_io_op() to filter BLKIF_OP_RESERVED_1 operation (Dongli Zhang) [Orabug: 29237430] - xen/blkback: do not BUG() for invalid blkif_request from frontend (Dongli Zhang) [Orabug: 29237430] - net/rds: WARNING: at net/rds/recv.c:222 rds_recv_hs_exthdrs+0xf8/0x1e0 (Venkat Venkatsubra) [Orabug: 29248238] - kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (Eduardo Habkost) [Orabug: 29254549] - alarmtimer: Prevent overflow for relative nanosleep (Thomas Gleixner) [Orabug: 29269148] {CVE-2018-13053}

[4.14.35-1844.2.2.el7uek]
- genirq/affinity: Don't return with empty affinity masks on error (Thomas Gleixner) [Orabug: 29209330] - x86/apic/x2apic: set affinity of a single interrupt to one cpu (Jianchao Wang) [Orabug: 29201434] - uek-rpm: Update x86_64 config options (Victor Erminpour) [Orabug: 29129556] - net: rds: fix excess initialization of the recv SGEs (Zhu Yanjun) [Orabug: 29004501] - nvme-pci: fix memory leak on probe failure (Keith Busch) [Orabug: 29214245] - nvme-pci: limit max IO size and segments to avoid high order allocations (Jens Axboe) [Orabug: 29214245] 
- arm64, dtrace: add non-virtual clocksources to fbt blacklist (Nick Alcock) [Orabug: 29220926] - net/rds: ib: Fix endless RNR Retries caused by memory allocation failures (Venkat Venkatsubra) [Orabug: 29222874] - x86/speculation: simplify IBRS firmware control (Alexandre Chartre) [Orabug: 29225114] - x86/speculation: use jump label instead of alternative to control IBRS firmware (Alexandre Chartre) [Orabug: 29225114] - x86/speculation: fix and simplify IBPB control (Alexandre Chartre) [Orabug: 29225114] - x86/speculation: use jump label instead of alternative to control IBPB (Alexandre Chartre) [Orabug: 29225114] - x86/speculation: move ANNOTATE_* macros to a new header file (Alexandre Chartre) [Orabug: 29225114] - be2net: Update the driver version to 12.0.0.0 (Suresh Reddy) [Orabug: 29228473] - be2net: Handle transmit completion errors in Lancer (Suresh Reddy) [Orabug: 29228473] - be2net: Fix HW stall issue in Lancer (Suresh Reddy) [Orabug: 29228473] - x86/platform/UV: Fix GAM MMR references in the UV x2apic code (Mike Travis) [Orabug: 29205471] - x86/platform/UV: Fix GAM MMR changes in UV4A (Mike Travis) [Orabug: 29205471] - x86/platform/UV: Add references to access fixed UV4A HUB MMRs (Mike Travis) [Orabug: 29205471] - x86/platform/UV: Fix UV4A support on new Intel Processors (Mike Travis) [Orabug: 29205471] - x86/platform/UV: Update uv_mmrs.h to prepare for UV4A fixes (Mike Travis) [Orabug: 29205471]

[4.14.35-1844.2.1.el7uek]
- rds: Incorrect rds-info send and retransmission message output (Ka-Cheong Poon) [Orabug: 29024033] - mlx4_core: Disable P_Key Violation Traps (H&aring kon Bugge) [Orabug: 28861014] - rds: ib: Use a delay when reconnecting to the very same IP address (H&aring kon Bugge) [Orabug: 29161391] - KVM: Fix UAF in nested posted interrupt processing (Cfir Cohen) [Orabug: 29172125] {CVE-2018-16882}
- x86/alternative: check int3 breakpoint physical addresses (Alexandre Chartre) [Orabug: 29178334] - Change mincore() to count 'mapped' pages rather than 'cached' pages (Linus Torvalds) [Orabug: 29187408] {CVE-2019-5489}
- net/rds: RDS connection does not reconnect after CQ access violation error (Venkat Venkatsubra) [Orabug: 29180514]

[4.14.35-1844.2.0.el7uek]
- userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli) [Orabug: 29163742] {CVE-2018-18397}
- userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli) [Orabug: 29163742] {CVE-2018-18397}
- ocfs2: don't clear bh uptodate for block read (Junxiao Bi) [Orabug: 29159655] - ocfs2: clear journal dirty flag after shutdown journal (Junxiao Bi) [Orabug: 29154599] - ocfs2: fix panic due to unrecovered local alloc (Junxiao Bi) [Orabug: 29154599]

Description of changes:

[2.6.39-400.306.1.el6uek]
- ext4: validate that metadata blocks do not overlap superblock (Theodore Ts'o) [Orabug: 28220576] {CVE-2018-1094}
- Provide a NLM_F_* flag void dumping inet/inet6 stats in rtnl_if_info() (Manish Kumar Singh) [Orabug: 28318718]
- btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (Qu Wenruo) [Orabug: 29301108] {CVE-2018-14609}

Description of changes:

[3.8.13-118.30.1.el7uek]
- ext4: validate that metadata blocks do not overlap superblock (Theodore Ts'o)  [Orabug: 28220451]  {CVE-2018-1094}
- ext4: always initialize the crc32c checksum driver (Theodore Ts'o)  [Orabug: 28220451]  {CVE-2018-1094} {CVE-2018-1094}
- vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags (David Howells)  [Orabug: 28220451]  {CVE-2018-1094}
- ocfs2: should wait dio before inode lock in ocfs2_setattr() (alex chen)  [Orabug: 28852830]  {CVE-2017-18204}
- Make file credentials available to the seqfile interfaces (Linus Torvalds)  [Orabug: 29114878]  {CVE-2018-17972}
- proc: restrict kernel stack dumps to root (Jann Horn)  [Orabug: 29114878]  {CVE-2018-17972}
- btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (Qu Wenruo)  [Orabug: 29301105]  {CVE-2018-14609}

Description of changes:

[4.1.12-124.25.1.el6uek]
- x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR (Tom Lendacky) [Orabug: 28870524] {CVE-2018-3639}
- x86/bugs: Add AMD's SPEC_CTRL MSR usage (Konrad Rzeszutek Wilk) [Orabug: 28870524] {CVE-2018-3639}
- x86/cpufeatures: rename X86_FEATURE_AMD_SSBD to X86_FEATURE_LS_CFG_SSBD (Mihai Carabas) [Orabug: 28870524] {CVE-2018-3639}
- Make file credentials available to the seqfile interfaces (Linus Torvalds) [Orabug: 29114879] {CVE-2018-17972}
- proc: restrict kernel stack dumps to root (Jann Horn) [Orabug: 29114879] {CVE-2018-17972}
- x86/speculation: Clean up retpoline code in bugs.c (Alejandro Jimenez) [Orabug: 29211617] - x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE (WANG Chao) [Orabug: 29211617] - x86/build: Fix compiler support check for CONFIG_RETPOLINE (Masahiro Yamada) [Orabug: 29211617] - x86/retpoline: Remove minimal retpoline support (Zhenzhong Duan) [Orabug: 29211617] - x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support (Zhenzhong Duan) [Orabug: 29211617] - nl80211: check for the required netlink attributes presence (Vladis Dronov) [Orabug: 29245533] {CVE-2017-12153} {CVE-2017-12153}
- scsi: lpfc: Fix PT2PT PRLI reject (reapply patch) (James Smart) [Orabug: 29281346]

From Red Hat Security Advisory 2019:0270 :

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

* Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

* Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

* Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

* libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

From Red Hat Security Advisory 2019:0269 :

An update for thunderbird is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

* Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

* Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

* Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

* libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

Description of changes:

[4.1.12-124.24.5.el7uek]
- rds: congestion updates can be missed when kernel low on memory (Mukesh Kacker)  [Orabug: 28425811]
- net/rds: ib: Fix endless RNR Retries caused by memory allocation failures (Venkat Venkatsubra)  [Orabug: 28127993]
- net: rds: fix excess initialization of the recv SGEs (Zhu Yanjun)  [Orabug: 29004503]
- xhci: fix usb2 resume timing and races. (Mathias Nyman)  [Orabug: 29028940]
- xhci: Fix a race in usb2 LPM resume, blocking U3 for usb2 devices (Mathias Nyman)  [Orabug: 29028940]
- userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli)  [Orabug: 29163750]  {CVE-2018-18397}
- userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli)  [Orabug: 29163750]  {CVE-2018-18397}
- x86/apic/x2apic: set affinity of a single interrupt to one cpu (Jianchao Wang)  [Orabug: 29196396]
- xen/blkback: rework validate_io_op() (Dongli Zhang)  [Orabug: 29199843]
- xen/blkback: optimize validate_io_op() to filter BLKIF_OP_RESERVED_1 operation (Dongli Zhang)  [Orabug: 29199843]
- xen/blkback: do not BUG() for invalid blkif_request from frontend (Dongli Zhang)  [Orabug: 29199843]
- net/rds: WARNING: at net/rds/recv.c:222 rds_recv_hs_exthdrs+0xf8/0x1e0 (Venkat Venkatsubra)  [Orabug: 29201779]
- xen-netback: wake up xenvif_dealloc_kthread when it should stop (Dongli Zhang)  [Orabug: 29217927]
- Revert 'xfs: remove nonblocking mode from xfs_vm_writepage' (Wengang Wang)  [Orabug: 29279692]
- Revert 'xfs: remove xfs_cancel_ioend' (Wengang Wang)  [Orabug: 29279692]
- Revert 'xfs: Introduce writeback context for writepages' (Wengang Wang)  [Orabug: 29279692]
- Revert 'xfs: xfs_cluster_write is redundant' (Wengang Wang)  [Orabug: 29279692]
- Revert 'xfs: factor mapping out of xfs_do_writepage' (Wengang Wang)  [Orabug: 29279692]
- Revert 'xfs: don't chain ioends during writepage submission' (Wengang Wang)  [Orabug: 29279692]

[4.1.12-124.24.4.el7uek]
- mstflint: Fix coding style issues - left with LINUX_VERSION_CODE (Idan Mehalel)  [Orabug: 28878697]
- mstflint: Fix coding-style issues (Idan Mehalel)  [Orabug: 28878697]
- mstflint: Fix errors found with checkpatch script (Idan Mehalel)  [Orabug: 28878697]
- Added support for 5th Gen devices in Secure Boot module and mtcr (Adham Masarwah)  [Orabug: 28878697]
- Fix typos in mst_kernel (Adham Masarwah)  [Orabug: 28878697]
- bnxt_en: Report PCIe link properties with pcie_print_link_status() (Brian Maly)  [Orabug: 28942099]
- selinux: Perform both commoncap and selinux xattr checks (Eric W. Biederman)  [Orabug: 28951521]
- Introduce v3 namespaced file capabilities (Serge E. Hallyn)  [Orabug: 28951521]
- rds: ib: Use a delay when reconnecting to the very same IP address (H&aring kon Bugge)  [Orabug: 29138813]
- Change mincore() to count 'mapped' pages rather than 'cached' pages (Linus Torvalds)  [Orabug: 29187415]  {CVE-2019-5489}
- NFSD: Set the attributes used to store the verifier for EXCLUSIVE4_1 (Kinglong Mee)  [Orabug: 29204157]

From Red Hat Security Advisory 2019:0232 :

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es) :

* spice: Off-by-one error in array access in spice/server/memslot.c (CVE-2019-3813)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Christophe Fergeau (Red Hat).

ID	Name	Severity
124135	Oracle Linux 7 : java-11-openjdk (ELSA-2019-0778)	High
124134	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2019-0775)	High
124133	Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-0774)	High
124097	Oracle Linux 7 : mod_auth_mellon (ELSA-2019-0766)	Medium
124048	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4612)	High
124014	Oracle Linux 6 : kernel (ELSA-2019-0717)	Medium
123986	Oracle Linux 6 : openssh (ELSA-2019-0711)	Medium
123962	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2019-4601)	Medium
123961	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4600)	High
123960	Oracle Linux 7 : python (ELSA-2019-0710)	Medium
123646	Oracle Linux 7 : freerdp (ELSA-2019-0697)	High
123631	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4596)	High
123485	Oracle Linux 7 : thunderbird (ELSA-2019-0681)	Medium
123484	Oracle Linux 6 : thunderbird (ELSA-2019-0680)	Medium
123483	Oracle Linux 7 : libssh2 (ELSA-2019-0679)	High
123431	Oracle Linux 6 : firefox (ELSA-2019-0672)	High
123430	Oracle Linux 7 : firefox (ELSA-2019-0671)	High
123145	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4594)	Medium
123122	Oracle Linux 7 : openwsman (ELSA-2019-0638)	Medium
123055	Oracle Linux 7 : ghostscript (ELSA-2019-0633)	Medium
122992	Oracle Linux 6 : firefox (ELSA-2019-0623)	Medium
122991	Oracle Linux 7 : firefox (ELSA-2019-0622)	Medium
122938	Oracle Linux 7 : cloud-init (ELSA-2019-0597)	Low
122864	Oracle Linux 7 : kernel (ELSA-2019-0512)	High
122863	Oracle Linux 7 : tomcat (ELSA-2019-0485)	Medium
122838	Oracle Linux 7 : openssl (ELSA-2019-0483)	Low
122805	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2019-4577)	High
122804	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4576)	High
122803	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4575)	High
122802	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4570)	High
122801	Oracle Linux 7 : cockpit (ELSA-2019-0482)	Medium
122633	Oracle Linux 7 : java-1.7.0-openjdk (ELSA-2019-0464)	Medium
122632	Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2019-0462)	Medium
122575	Oracle Linux 7 : java-11-openjdk (ELSA-2019-0436)	Medium
122574	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2019-0435)	Medium
122462	Oracle Linux 6 : polkit (ELSA-2019-0420)	Medium
122461	Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-0416)	Medium
122460	Oracle Linux 6 : kernel (ELSA-2019-0415)	Medium
122328	Oracle Linux 7 : flatpak (ELSA-2019-0375)	Medium
122327	Oracle Linux 7 : firefox (ELSA-2019-0374)	Medium
122326	Oracle Linux 6 : firefox (ELSA-2019-0373)	Medium
122325	Oracle Linux 7 : systemd (ELSA-2019-0368)	Medium
122141	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4541)	High
122045	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2019-4533)	High
122044	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4532)	High
121630	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4531) (Spectre)	Medium
121584	Oracle Linux 7 : thunderbird (ELSA-2019-0270)	High
121583	Oracle Linux 6 : thunderbird (ELSA-2019-0269)	High
121566	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4528)	Low
121526	Oracle Linux 6 : spice-server (ELSA-2019-0232)	Medium

Oracle Linux Local Security Checks Family for Nessus