Vulnerabilities Weekly Summary Ending September 2

By Jerry Adams on September 1, 2016

This week VMWare, Apple, Adobe and Google all released security updates addressing a few vulnerabilities for vRealize, iOS, ColdFusion and Chrome respectively.

VMWare releases security advisor regarding issues affecting VMWare Identity Manager and vRealize Automation

Identity Manager and vRealize Automation are both affected by a vulnerability that may allow for privileged escalation. vRealize Automation also suffers from a vulnerability that may allow for remote code execution and if exploited could also lead to privilege escalation (“VMware Security Advisories: VMSA-2016-0013”, 22 Aug. 2016).

CVE-2016-5335 – “VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors” (CVE.MITRE.org).
CVE-2016-5336 – “VMware vRealize Automation 7.0.x before 7.1 allows remote attackers to execute arbitrary code via unspecified vectors.” (CVE.MITRE.org).

Apple released security updates to iOS 9.3.5

iOS 9.3.5 suffers from several vulnerabilities which if exploited may result in code execution, or memory disclosure that could lead to privileged escalation (“About the security content of iOS 9.3.5“, 25 Aug. 2016).

CVE-2016-4655 – “The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.” (CVE.MITRE.org).
CVE-2016-4656 – “The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app” (CVE.MITRE.org).
CVE-2016-4657 – “WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site” (CVE.MITRE.org).

Adobe releases Hotfixes for ColdFusion

Adobe released a hotfix to address a single vulnerability in ColdFusion that if exploited could result in information disclosure (“Adobe Security Bulletin….“, 30 Aug. 2016).

CVE-2016-4264 – “issue associated with parsing crafted XML entities that could lead to information disclosure” (CVE.MITRE.org).

Chrome 53 released, 21 vulnerabilities addressed

Google/Alphabet released Chrome version 53.0.2785.89 which contains 21 security fixes, below are a list of the high priority vulnerabilities it addresses (Govind, K., 2016 Aug. 31):

CVE-2016-5147: “Universal XSS in Blink”
CVE-2016-5148: “Universal XSS in Blink”
CVE-2016-5149: “Script injection in extensions”
CVE-2016-5150: “Use after free in Blink”
CVE-2016-5151: “Use after free in PDFium”
CVE-2016-5152: “Heap overflow in PDFium”
CVE-2016-5153: “Use after destruction in Blink”
CVE-2016-5154: “Heap overflow in PDFium”
CVE-2016-5155: “Address bar spoofing”
CVE-2016-5156: “Use after free in event bindings”
CVE-2016-5157: “Heap overflow in PDFium”
CVE-2016-5158: “Heap overflow in PDFium”
CVE-2016-5159: “Heap overflow in PDFium”

References:

(22 Aug. 2016). “VMware Security Advisories: VMSA-2016-0013”. VMWare, Inc. Retrieved from http://www.vmware.com/security/advisories/VMSA-2016-0013.html
(25 Aug. 2016). “About the security content of iOS 9.3.5“. Apple, Inc. Retrieved from https://support.apple.com/en-us/HT207107
(30 Aug. 2016). “Adobe Security Bulletin – Security Update: Hotfixes available for ColdFusion“. Adobe Systems. Retrieved from https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html
Govind, K. (2016 Aug. 31). “Stable Channel Update”. Chrome Releases [Weblog]. Alphabet, Inc. Retrieved from http://googlechromereleases.blogspot.com/search/label/Stable%20updates
CVE.MITRE.org. CVE International in scope and free for public use in accordance with terms of use, CVE is a dictionary of publicly known information security vulnerabilities and exposures.