All Vulnerability Reports

USN-3205-1 tcpdump vulnerabilities


Severity

Medium

References

Description

CVEs contained in this USN include: CVE-2016-7922, CVE-2016-7923, CVE-2016-7924, CVE-2016-7925, CVE-2016-7926, CVE-2016-7927, CVE-2016-7928, CVE-2016-7929, CVE-2016-7930, CVE-2016-7931, CVE-2016-7932, CVE-2016-7933, CVE-2016-7934, CVE-2016-7935, CVE-2016-7936, CVE-2016-7937, CVE-2016-7938, CVE-2016-7939, CVE-2016-7940, CVE-2016-7973, CVE-2016-7974, CVE-2016-7975, CVE-2016-7983, CVE-2016-7984, CVE-2016-7985, CVE-2016-7986, CVE-2016-7992, CVE-2016-7993, CVE-2016-8574, CVE-2016-8575, CVE-2017-5202, CVE-2017-5203, CVE-2017-5204, CVE-2017-5205, CVE-2017-5341, CVE-2017-5342, CVE-2017-5482, CVE-2017-5483, CVE-2017-5484, CVE-2017-5485, CVE-2017-5486

Affected VMware Products and Versions

Severity is medium unless otherwise noted.

  • Vulnerable Cloud Foundry components individually listed here.
  • Pivotal products using CF components prior to the listed updated versions are vulnerable to this issue. See the Mitigation section below for more information.

Mitigation

Users of affected versions should apply the following mitigation:

  • The Cloud Foundry team recommends upgrading BOSH stemcells and/or other OSS components listed here if applicable.
  • Upgrade Pivotal products using older stemcells (and older rootfs for PCF Elastic Runtime) to new versions using the new stemcells mentioned above. On the Pivotal Network product page for each release, check the Depends On section and/or Release Notes for this information.
  • Releases that have fixed this issue include:
    • PCF Operations Manager: 1.6.29, 1.7.23, 1.8.15, 1.9.4
    • PCF Elastic Runtime: 1.6.71, 1.7.56, 1.8.35, 1.9.13, 1.10.1
    • MySQL for PCF: 1.6.24, 1.7.24, 1.8.4
    • RabbitMQ for PCF: 1.5.25, 1.6.15, 1.7.13
    • Redis for PCF: 1.5.28, 1.6.5, 1.7.2
    • PCF Metrics: 1.0.24
    • Ops Metrics / JMX Bridge: 1.6.29
    • Spring Cloud Services for PCF: 1.0.21, 1.1.12, 1.2.8
    • Single Sign-On for PCF: 1.0.21

Special Note for 1.7.x, 1.8.x & 1.9.x Ops Manager Deployments

The 1.7.x, 1.8.x and 1.9.x release line of Ops Manager includes a new feature that allows tile stemcells to “float”, which will allow Operators to update their Ops Manager deployment once rather than installing all new Services product releases. If you upgrade one Service tile in Ops Manager 1.7.x, 1.8.x or 1.9.x with the newly released stemcell, all tiles will automatically upgrade. For more information about the floating stemcell feature, refer to this document.