Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.2004
Moderate: v8314-v8 security update
31 October 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: v8314-v8
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux WS/Desktop 6
Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-5256 CVE-2014-1704 CVE-2013-6668
CVE-2013-6650 CVE-2013-6640 CVE-2013-6639
Reference: ASB-2014.0025
ASB-2014.0023
ASB-2014.0009
ASB-2013.0135
ESB-2014.1911
ESB-2014.1737
ESB-2014.1710
ESB-2014.0381
ESB-2014.0200
ESB-2013.1748
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2014-1744.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: v8314-v8 security update
Advisory ID: RHSA-2014:1744-01
Product: Red Hat Software Collections
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1744.html
Issue date: 2014-10-30
CVE Names: CVE-2013-6639 CVE-2013-6640 CVE-2013-6650
CVE-2013-6668 CVE-2014-1704 CVE-2014-5256
=====================================================================
1. Summary:
Updated v8314-v8 packages that fix multiple security issues are now
available for Red Hat Software Collections 1.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) - x86_64
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) - x86_64
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) - x86_64
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) - x86_64
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) - x86_64
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) - x86_64
3. Description:
V8 is Google's open source JavaScript engine.
It was discovered that V8 did not properly check the stack size limit in
certain cases. A remote attacker able to send a request that caused a
script executed by V8 to use deep recursion could trigger a stack overflow,
leading to a crash of an application using V8. (CVE-2014-5256)
Multiple flaws were discovered in V8. Untrusted JavaScript code executed by
V8 could use either of these flaws to crash V8 or, possibly, execute
arbitrary code with the privileges of the user running V8. (CVE-2013-6639,
CVE-2013-6640, CVE-2013-6650, CVE-2013-6668, CVE-2014-1704)
All v8314-v8 users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. All applications using
V8 must be restarted for this update to take effect.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1039888 - CVE-2013-6639 v8: DoS (out-of-bounds write) in DehoistArrayIndex function in hydrogen.cc
1039889 - CVE-2013-6640 v8: DoS (out-of-bounds read) in DehoistArrayIndex function in hydrogen.cc
1059070 - CVE-2013-6650 v8: incorrect handling of popular pages
1074737 - CVE-2013-6668 v8: multiple vulnerabilities fixed in Google Chrome version 33.0.1750.146
1077136 - CVE-2014-1704 v8: multiple vulnerabilities fixed in Google Chrome version 33.0.1750.149
1125464 - CVE-2014-5256 V8 Memory Corruption and Stack Overflow
1149781 - Several performance and security bug fixes from Fedora
6. Package List:
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6):
Source:
v8314-v8-3.14.5.10-6.el6.src.rpm
x86_64:
v8314-v8-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-debuginfo-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-devel-3.14.5.10-6.el6.x86_64.rpm
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4):
Source:
v8314-v8-3.14.5.10-6.el6.src.rpm
x86_64:
v8314-v8-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-debuginfo-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-devel-3.14.5.10-6.el6.x86_64.rpm
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5):
Source:
v8314-v8-3.14.5.10-6.el6.src.rpm
x86_64:
v8314-v8-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-debuginfo-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-devel-3.14.5.10-6.el6.x86_64.rpm
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6):
Source:
v8314-v8-3.14.5.10-6.el6.src.rpm
x86_64:
v8314-v8-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-debuginfo-3.14.5.10-6.el6.x86_64.rpm
v8314-v8-devel-3.14.5.10-6.el6.x86_64.rpm
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7):
Source:
v8314-v8-3.14.5.10-6.el7.src.rpm
x86_64:
v8314-v8-3.14.5.10-6.el7.x86_64.rpm
v8314-v8-debuginfo-3.14.5.10-6.el7.x86_64.rpm
v8314-v8-devel-3.14.5.10-6.el7.x86_64.rpm
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7):
Source:
v8314-v8-3.14.5.10-6.el7.src.rpm
x86_64:
v8314-v8-3.14.5.10-6.el7.x86_64.rpm
v8314-v8-debuginfo-3.14.5.10-6.el7.x86_64.rpm
v8314-v8-devel-3.14.5.10-6.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2013-6639
https://access.redhat.com/security/cve/CVE-2013-6640
https://access.redhat.com/security/cve/CVE-2013-6650
https://access.redhat.com/security/cve/CVE-2013-6668
https://access.redhat.com/security/cve/CVE-2014-1704
https://access.redhat.com/security/cve/CVE-2014-5256
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFUUjMtXlSAg2UNWIIRAoeGAJ0fP251E692cpwvk3D3KlOzu9Wk7QCcDWY7
WKdpvCmPusTh1N++FryNcSU=
=W37D
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVFLVfRLndAQH1ShLAQKotQ/+Mtff7PD4Jku/s359g9XR+uzKuEqGRe1d
dhJJe3LAzfOJQzaHQS29eJrM4Z7yCaOnKG7EvlIcWjCJP5yl4jfevWJx0Bxi6Vqo
XcMSYFk6sdCV9bEtpSjhCwV+XVQqYBcUcV0MDGjQlTHENe/0RARKZaTPkbXvS+Va
xDWLOtFVKUNNdfTzpsg+7b219WDojWl3+DigA+VKsf9euH3X79kgl4IIDb8wQ46e
s0qkuAjULeH1k/0iH4Js5i0EGxX4MonZyLKUL7R0g6K+jyzVGeAisNjAB474HoD8
MS2kr4iG9QEl2irdFlY2d5LECuKlIP6JIBb2oDm8W2ELGYiJKbnDc8g6UsGigNJl
Dnznol8V3KW9HWahWDoSEqSNt3SyDYUgxCJnBAJWBsIKAc2abKwnJn1LY+vcVkaU
AqsD9idbvK1kQkA0svBFpGSY57BV8CRDDt4XfEyhKKjdty7GAlJRlkGcqBgkoMQ0
GrvVXSO/Xf/1ZynjKWJn5kEB/JBRMFhOxN1KzRZdUbIFXn5sKtgXMats29t5F4dv
ZfujG4pBSjVZXKsEHfSQopYNGi2Oe+tTuwT5gXHcOfNyEMTuKBvs0aUnTr5SUKy/
qB5juE+/gg4LMLAwx24WPaeO5HyJ9lJUIpEo6G4oNCG9pthWfoKuq1jCTopv3Hfx
ezPl6ERqVIE=
=7WY8
-----END PGP SIGNATURE-----