An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.6.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

* Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

* Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791)

* Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

* Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

* Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

* Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

* Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.6.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

* Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

* Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791)

* Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

* Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

* Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

* Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

* Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for cloud-init is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es) :

* cloud-init: extra ssh keys added to authorized_keys on the Azure platform (CVE-2019-0816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updates for rh-dotnetcore10-dotnetcore, rh-dotnetcore11-dotnetcore, rh-dotnet21-dotnet, and rh-dotnet22-dotnet are now available for .NET Core on Red Hat Enterprise Linux.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

.NET Core is a managed-software framework. It implements the .NET standard APIs and several additional APIs, and it includes a CLR implementation.

New versions of .NET Core that address security vulnerabilities are now available. The updated versions are .NET Core 1.0.15, 1.1.12, 2.1.9, and 2.2.3.

Security Fix(es) :

* A tampering vulnerability exists in NuGet software when executed in a Linux or Mac environment. (CVE-2019-0757)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

For more information, please refer to the upstream doc in the References section.

An update for haproxy is now available for Red Hat OpenShift Container Platform 3.10.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security fix(es) :

* haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash (CVE-2018-20615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page (s) listed in the References section.

An update for haproxy is now available for Red Hat OpenShift Container Platform 3.9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security fix(es) :

* haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash (CVE-2018-20615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page (s) listed in the References section.

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

* kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks (CVE-2018-17972)

* kernel: Faulty computation of numberic bounds in the BPF verifier (CVE-2018-18445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* kernel-rt: update to the RHEL7.6.z batch#3 source tree (BZ#1672406)

Users of kernel-rt are advised to upgrade to these updated packages, which fix this bug.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

* kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks (CVE-2018-17972)

* kernel: Faulty computation of numberic bounds in the BPF verifier (CVE-2018-18445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) and Enhancement(s) :

* kernel fuse invalidates cached attributes during reads (BZ#1657921)

* [NetApp-FC-NVMe] RHEL7.6: nvme reset gets hung indefinitely (BZ#1659937)

* Memory reclaim deadlock calling __sock_create() after memalloc_noio_save() (BZ#1660392)

* hardened usercopy is causing crash (BZ#1660815)

* Backport: xfrm: policy: init locks early (BZ#1660887)

* AWS m5 instance type loses NVMe mounted volumes [was: Unable to Mount StatefulSet PV in AWS EBS] (BZ#1661947)

* RHEL 7.6 running on a VirtualBox guest with a GUI has a mouse problem (BZ# 1662848)

* Kernel bug report in cgroups on heavily contested 3.10 node (BZ#1663114)

* [PCIe] SHPC probe crash on Non-ACPI/Non-SHPC ports (BZ#1663241)

* [Cavium 7.7 Feat] qla2xxx: Update to latest upstream. (BZ#1663508)

* Regression in lpfc and the CNE1000 (BE2 FCoE) adapters that no longer initialize (BZ#1664067)

* [csiostor] call trace after command: modprobe csiostor (BZ#1665370)

* libceph: fall back to sendmsg for slab pages (BZ#1665814)

* Deadlock between stop_one_cpu_nowait() and stop_two_cpus() (BZ#1667328)

* Soft lockups occur when the sd driver passes a device size of 1 sector to string_get_size() (BZ#1667989)

* [RHEL7.7] BUG: unable to handle kernel paging request at ffffffffffffffff (BZ#1668208)

* RHEL7.6 - powerpc/pseries: Disable CPU hotplug across migrations / powerpc/ rtas: Fix a potential race between CPU-Offline & Migration (LPM) (BZ# 1669044)

* blk-mq: fix corruption with direct issue (BZ#1670511)

* [RHEL7][patch] iscsi driver can block reboot/shutdown (BZ#1670680)

* [DELL EMC 7.6 BUG] Unable to create-namespace over Dell NVDIMM-N (BZ# 1671743)

* efi_bgrt_init fails to ioremap error during boot (BZ#1671745)

* Unable to mount a share on kernel- 3.10.0-957.el7. The share can be mounted on kernel-3.10.0-862.14.4.el7 (BZ#1672448)

* System crash with RIP nfs_readpage_async+0x43 -- BUG: unable to handle kernel NULL pointer dereference (BZ#1672510)

Users of kernel are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* tomcat: Open redirect in default servlet (CVE-2018-11784)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for openssl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es) :

* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Perform the RSA signature self-tests with SHA-256 (BZ#1673914)

An update for cockpit is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es) :

* cockpit: Crash when parsing invalid base64 headers (CVE-2019-3804)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es) :

* kernel: out-of-bounds memcpy in fs/ext4/inline.c:ext4_read_inline_data() with crafted ext4 image (CVE-2018-11412)

* kernel: use-after-free in jbd2_journal_commit_transaction funtion (CVE-2018-10876)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* blk-mq IO hang in null_blk test (BZ#1581223)

* lpfc remove lpfc_enable_pbde module parameter. (BZ#1615875)

* RHEL-Alt-7.6 - [Power9][DD2.2][4.14.0-109]package installation segfaults inside debian chroot env in P9 KVM guest with HTM enabled (kvm) (BZ# 1628817)

* Pegas1.1 - [P9] 'threads=2' or higher is required to boot up VM with above 256 vcpu [rhel-alt-7.6.z] (BZ#1634653)

* RHEL-Alt-7.6 Snapshot5 - System crashed under stress-ng & HTX on the mix mode guest (kvm) (BZ#1637890)

* RHEL-Alt-7.6 - BostonESS:P9:DD2.01 - Testing Ethtool options 'r' and 'p' for the i40e driver causes the kernel to crash and reboots the server (i40e) (CORAL) (BZ#1644606)

* RHEL-Alt-7.6 Host/RHV4.2: system crashed and kdump failed to collect CPUs in KVM guests (BZ#1649196)

* RHEL-Alt-7.6 Host:BostonLC:P9:boslcp1: system crashed in
__find_linux_pte+0xac (kvm) (BZ#1651065)

* [LLNL 7.7 Bug] Rasdaemon doesn't seem to collect APEI errors (BZ#1664495)

Users of kernel are advised to upgrade to these updated packages, which fix these bugs.

An update for docker is now available for Red Hat Enterprise Linux 7 Extras.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Docker is an open source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that runs virtually anywhere.

Security Fix(es) :

* docker: Memory exhaustion via large integer used with --cpuset-mems or --cpuset-cpus (CVE-2018-20699)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* docker runc 'panic: runtime error: invalid memory address or nil pointer dereference' (BZ#1556901)

* temp files in /var/lib/docker persist (BZ#1645591)

* Docker needs to support PIDs Limit for all containers created.
(BZ#1660876)

* dockerd may leak memory resources if uncompressing a layer fails (BZ# 1661443)

* Docker may not properly close hijacked streams (BZ#1668042)

* Director deployed OCP 3.11 deployment fails with openshift-ansible getting stuck when restarting docker service on master nodes (BZ#1671861)

* Docker service hang (BZ#1678096)

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 72.0.3626.121.

Security Fix(es) :

* chromium-browser: Use-after-free in FileReader (CVE-2019-5786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal.

The following packages have been upgraded to a later upstream version:
rhvm-appliance (4.2). (BZ#1679415)

Security Fix(es) :

* systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for vdsm is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The VDSM service is required by a Virtualization Manager to manage the Linux hosts. VDSM manages and monitors the host's storage, memory and networks as well as virtual machine creation, other host administration tasks, statistics gathering, and log collection.

The following packages have been upgraded to a later upstream version:
vdsm (4.20.47). (BZ#1677458)

Security Fix(es) :

* vdsm: privilege escalation to root via systemd_run (CVE-2019-3831)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* VDSM attempted to collect OpenStack related information, even on hosts that are not connected to OpenStack, and displayed a repeated error message in the system log. In this release, errors originating from OpenStack related information are not recorded in the system log.
As a result, the system log is quieter. (BZ#1673765)

An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor.
Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.

The following packages have been upgraded to a later upstream version:
redhat-release-virtualization-host (4.2), redhat-virtualization-host (4.2). (BZ #1678629, BZ#1679414)

Security Fix(es) :

* spice: Off-by-one error in array access in spice/server/memslot.c (CVE-2019-3813)

* systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

* vdsm: privilege escalation to root via systemd_run (CVE-2019-3831)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP40.

Security Fix(es) :

* IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 7 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP40.

Security Fix(es) :

* IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 7 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR5-FP30.

Security Fix(es) :

* IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)

* IBM JDK: missing null check when accelerating Unsafe calls (CVE-2018-12549)

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

* Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment) (CVE-2019-2449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR5-FP30.

Security Fix(es) :

* IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)

* IBM JDK: missing null check when accelerating Unsafe calls (CVE-2018-12549)

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

* Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment) (CVE-2019-2449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for ansible is now available for Ansible Engine 2.6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.

The following packages have been upgraded to a newer upstream version:
ansible (2.6.14)

Security fix(es) :

* ansible: path traversal in the fetch module (CVE-2019-3828)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

See https://github.com/ansible/ansible/blob/v2.6.14/changelogs/ CHANGELOG-v2.6.rst for details on bug fixes in this release.

An update for ansible is now available for Ansible Engine 2.5.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.

The following packages have been upgraded to a newer upstream version:
ansible (2.5.15)

Security fix(es) :

* ansible: path traversal in the fetch module (CVE-2019-3828)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

See https://github.com/ansible/ansible/blob/v2.5.15/changelogs/ CHANGELOG-v2.5.rst for details on bug fixes in this release.

An update for ansible is now available for Ansible Engine 2.7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.

The following packages have been upgraded to a newer upstream version:
ansible (2.7.8)

Security fix(es) :

* ansible: path traversal in the fetch module (CVE-2019-3828)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

See https://github.com/ansible/ansible/blob/v2.7.8/changelogs/ CHANGELOG-v2.7.rst for details on bug fixes in this release.

An update for ansible is now available for Ansible Engine 2.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.

The following packages have been upgraded to a newer upstream version:
ansible (2.7.8)

Security fix(es) :

* ansible: path traversal in the fetch module (CVE-2019-3828)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

See https://github.com/ansible/ansible/blob/v2.7.8/changelogs/ CHANGELOG-v2.7.rst for details on bug fixes in this release.

An update is now available for Red Hat JBoss Web Server 5.0 for RHEL 6 and Red Hat JBoss Web Server 5.0 for RHEL 7.

Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.0 Service Pack 2 serves as a replacement for Red Hat JBoss Web Server 5.0 Service Pack 1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

* tomcat: host name verification missing in WebSocket client (CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for polkit is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.

Security Fix(es) :

* polkit: Temporary auth hijacking via PID reuse and non-atomic fork (CVE-2019-6133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Previously backported upstream patch caused a change in the behavior of page fault handler. As a consequence, applications compiled through GNU Compiler Collection (GCC) version 4.4.7 sometimes generated stack access exceeding the 64K limit. Running such applications subsequently triggered a segmentation fault. With this update, the 64k limit check in the page fault handler has been removed. As a result, running the affected applications no longer triggers the segmentation fault in the described scenario.

Note that removing the limit check does not impact the integrity of the kernel itself. (BZ#1644401)

An update is now available for Red Hat OpenShift Container Platform 3.4, 3.5, 3.6, and 3.7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

Security Fix(es) :

* A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. (CVE-2019-5736)

All OpenShift Container Platform 3 users are advised to upgrade to these updated packages.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 72.0.3626.96.

Security Fix(es) :

* chromium-browser: Inappropriate implementation in V8 (CVE-2019-5784)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for flatpak is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es) :

* flatpak: potential /proc based sandbox escape (CVE-2019-8308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.5.1 ESR.

Security Fix(es) :

* chromium-browser, mozilla: Use after free in Skia (CVE-2018-18356)

* mozilla: Integer overflow in Skia (CVE-2019-5785)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.5.1 ESR.

Security Fix(es) :

* chromium-browser, mozilla: Use after free in Skia (CVE-2018-18356)

* mozilla: Integer overflow in Skia (CVE-2019-5785)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for systemd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es) :

* systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 7.1.6 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.5, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* wildfly-core: Cross-site scripting (XSS) in JBoss Management Console (CVE-2018-10934)

* undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer (CVE-2018-14642)

* dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents (CVE-2018-1000632)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 7.1.6 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.5, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* wildfly-core: Cross-site scripting (XSS) in JBoss Management Console (CVE-2018-10934)

* undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer (CVE-2018-14642)

* dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents (CVE-2018-1000632)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal.

Security Fix(es) :

* systemd: stack overflow when calling syslog from a command with long cmdline (CVE-2018-16864)

* systemd: stack overflow when receiving many journald entries (CVE-2018-16865)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updates for rh-dotnetcore10-dotnetcore, rh-dotnetcore11-dotnetcore, rh-dotnet21-dotnet, and rh-dotnet22-dotnet are now available for .NET Core on Red Hat Enterprise Linux.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET Core that address security vulnerabilities are now available. The updated versions are .NET Core 1.0.14, 1.1.11, 2.1.8, and 2.2.2.

Security Fix(es) :

* .dotnet: Domain-spoofing attack in System.Uri (CVE-2019-0657)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

For more information, please refer to the upstream doc in the References section.

An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor.
Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.

Security Fix(es) :

* systemd: stack overflow when calling syslog from a command with long cmdline (CVE-2018-16864)

* systemd: stack overflow when receiving many journald entries (CVE-2018-16865)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for JBoss Core Services on RHEL 6 and RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.29 Service Pack 1 serves as an update to Red Hat JBoss Core Services Apache HTTP Server 2.4.29, and includes bug fixes for CVEs which are linked to in the References section.

Security Fixes :

* httpd: DoS for HTTP/2 connections by continuous SETTINGS (CVE-2018-11763)

* httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

* httpd: Out of bound access after failure in reading the HTTP request (CVE-2018-1301)

* httpd: Use-after-free on HTTP/2 stream shutdown (CVE-2018-1302)

* httpd: bypass with a trailing newline in the file name (CVE-2017-15715)

* httpd: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)

* httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause a denial of service (CVE-2018-1303)

* httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications (CVE-2018-1283)

* httpd: mod_http2: too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

* mod_jk: connector path traversal due to mishandled HTTP requests in httpd (CVE-2018-11759)

* nghttp2: NULL pointer dereference when too large ALTSVC frame is received (CVE-2018-1000168)

* openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739)

Details around each issue, including information about the CVE, severity of the issue, and the CVSS score, can be found on the CVE pages listed in the Reference section below.

An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update upgrades Flash Player to version 32.0.0.142.

Security Fix(es) :

* flash-plugin: Information Disclosure vulnerability (APSB19-06) (CVE-2019-7090)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for kernel is now available for Red Hat Enterprise Linux 7.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* The timeout handling in the libfc.ko kernel module did not work correctly. This was happening during certain steps of the Fibre Channel login procedure, when the timeout handling was not synchronized with the state of a partially offloaded Fibre Channel over Ethernet (FCoE) in the lower-level driver. Consequently, the offloaded FCoE state was incorrect, which led to I/O timeout errors until the SCSI error recovery issued a host reset. This update fixes the bug by improving the libfc.ko error handling during the fabric login. As a result, the fabric login errors are addressed in time, without the I/O timeouts in the described scenario. (BZ#1655042)

* Symmetric Multi-Processing (SMP) or Non-Uniform Memory Access (NUMA) systems in some cases experienced deadlocks during a task migration and task wakeup operations. Consequently, the systems terminated unexpectedly with the following message :

NMI watchdog: Watchdog detected hard LOCKUP on

This update fixes the bug by queueing the stopper thread to run after locks are released. As a result, the deadlocks and the system crashes no longer occur in the described scenario. (BZ#1667326)

Users of kernel are advised to upgrade to these updated packages, which fix these bugs.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 72.0.3626.81.

Security Fix(es) :

* chromium-browser: Inappropriate implementation in QUIC Networking (CVE-2019-5754)

* chromium-browser: Inappropriate implementation in V8 (CVE-2019-5755)

* chromium-browser: Use after free in PDFium (CVE-2019-5756)

* chromium-browser: Type Confusion in SVG (CVE-2019-5757)

* chromium-browser: Use after free in Blink (CVE-2019-5758)

* chromium-browser: Use after free in HTML select elements (CVE-2019-5759)

* chromium-browser: Use after free in WebRTC (CVE-2019-5760)

* chromium-browser: Use after free in SwiftShader (CVE-2019-5761)

* chromium-browser: Use after free in PDFium (CVE-2019-5762)

* chromium-browser: Insufficient validation of untrusted input in V8 (CVE-2019-5763)

* chromium-browser: Use after free in WebRTC (CVE-2019-5764)

* chromium-browser: Insufficient policy enforcement in the browser (CVE-2019-5765)

* chromium-browser: Inappropriate implementation in V8 (CVE-2019-5782)

* chromium-browser: Insufficient policy enforcement in Canvas (CVE-2019-5766)

* chromium-browser: Incorrect security UI in WebAPKs (CVE-2019-5767)

* chromium-browser: Insufficient policy enforcement in DevTools (CVE-2019-5768)

* chromium-browser: Insufficient validation of untrusted input in Blink (CVE-2019-5769)

* chromium-browser: Heap buffer overflow in WebGL (CVE-2019-5770)

* chromium-browser: Heap buffer overflow in SwiftShader (CVE-2019-5771)

* chromium-browser: Use after free in PDFium (CVE-2019-5772)

* chromium-browser: Insufficient data validation in IndexedDB (CVE-2019-5773)

* chromium-browser: Insufficient validation of untrusted input in SafeBrowsing (CVE-2019-5774)

* chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2019-5775)

* chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2019-5776)

* chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2019-5777)

* chromium-browser: Insufficient policy enforcement in Extensions (CVE-2019-5778)

* chromium-browser: Insufficient policy enforcement in ServiceWorker (CVE-2019-5779)

* chromium-browser: Insufficient policy enforcement (CVE-2019-5780)

* chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2019-5781)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for docker is now available for Red Hat Enterprise Linux 7 Extras.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Docker is an open source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that runs virtually anywhere.

Security Fix(es) :

* A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. (CVE-2019-5736)

Additional details about this flaw, including mitigation information, can be found in the vulnerability article linked from the Reference section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for runc is now available for Red Hat Enterprise Linux 7 Extras.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es) :

* A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. (CVE-2019-5736)

Additional details about this flaw, including mitigation information, can be found in the vulnerability article linked from the Reference section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ID	Name	Severity
122994	RHEL 6 : firefox (RHSA-2019:0623)	Medium
122993	RHEL 7 : firefox (RHSA-2019:0622)	Medium
122939	RHEL 7 : cloud-init (RHSA-2019:0597)	Medium
122886	RHEL 7 : dotNET (RHSA-2019:0544)	Medium
122866	RHEL 7 : OpenShift Container Platform 3.10 haproxy (RHSA-2019:0548)	High
122865	RHEL 7 : OpenShift Container Platform 3.9 haproxy (RHSA-2019:0547)	High
122843	RHEL 7 : kernel-rt (RHSA-2019:0514)	High
122842	RHEL 7 : kernel (RHSA-2019:0512)	High
122841	RHEL 7 : tomcat (RHSA-2019:0485)	Medium
122840	RHEL 7 : openssl (RHSA-2019:0483)	Low
122839	RHEL 7 : cockpit (RHSA-2019:0482)	High
122807	RHEL 7 : kernel-alt (RHSA-2019:0525)	Medium
122806	RHEL 7 : docker (RHSA-2019:0487)	Medium
122771	RHEL 6 : chromium-browser (RHSA-2019:0481)	Critical
122739	RHEL 7 : Virtualization Manager (RHSA-2019:0461)	Medium
122738	RHEL 7 : Virtualization Manager (RHSA-2019:0458)	Medium
122737	RHEL 7 : Virtualization Manager (RHSA-2019:0457)	Medium
122713	RHEL 6 : java-1.7.1-ibm (RHSA-2019:0474)	High
122712	RHEL 7 : java-1.7.1-ibm (RHSA-2019:0473)	High
122711	RHEL 7 : java-1.8.0-ibm (RHSA-2019:0472)	High
122659	RHEL 6 : java-1.8.0-ibm (RHSA-2019:0469)	High
122639	RHEL 7 : java-1.7.0-openjdk (RHSA-2019:0464)	Medium
122638	RHEL 6 : java-1.7.0-openjdk (RHSA-2019:0462)	Medium
122637	RHEL 7 : ansible (RHSA-2019:0433)	Low
122636	RHEL 7 : ansible (RHSA-2019:0432)	Low
122635	RHEL 7 : ansible (RHSA-2019:0431)	Low
122634	RHEL 7 : ansible (RHSA-2019:0430)	Low
122606	RHEL 6 / 7 : Red Hat JBoss Web Server 5.0 Service Pack 2 (RHSA-2019:0451)	High
122526	RHEL 7 : java-11-openjdk (RHSA-2019:0436)	Medium
122525	RHEL 7 : java-1.8.0-openjdk (RHSA-2019:0435)	Medium
122465	RHEL 6 : polkit (RHSA-2019:0420)	Medium
122464	RHEL 6 : java-1.8.0-openjdk (RHSA-2019:0416)	Medium
122463	RHEL 6 : kernel (RHSA-2019:0415)	Medium
122442	RHEL 7 : OpenShift Container Platform 3.4, 3.5, 3.6, and 3.7 (RHSA-2019:0408)	High
122441	RHEL 6 : chromium-browser (RHSA-2019:0396)	High
122337	RHEL 7 : flatpak (RHSA-2019:0375)	Medium
122336	RHEL 7 : firefox (RHSA-2019:0374)	Medium
122335	RHEL 6 : firefox (RHSA-2019:0373)	Medium
122334	RHEL 7 : systemd (RHSA-2019:0368)	Medium
122333	RHEL 7 : JBoss EAP (RHSA-2019:0365)	Medium
122332	RHEL 6 : JBoss EAP (RHSA-2019:0364)	Medium
122331	RHEL 7 : Virtualization Manager (RHSA-2019:0361)	Medium
122330	RHEL 7 : dotNET (RHSA-2019:0349)	Medium
122329	RHEL 7 : Virtualization Manager (RHSA-2019:0342)	Medium
122292	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367)	Medium
122175	RHEL 6 : flash-plugin (RHSA-2019:0348)	High
122142	RHEL 7 : kernel (RHSA-2019:0324)	Low
122112	RHEL 6 : chromium-browser (RHSA-2019:0309)	Medium
122111	RHEL 7 : docker (RHSA-2019:0304)	High
122110	RHEL 7 : runc (RHSA-2019:0303)	High

Red Hat Local Security Checks Family for Nessus