Information disclosure in Oracle VM Server for x86 and Oracle Linux - CVE-2016-8635

Vulnerability identifier: #VU4084

CSH Severity: Low

CVSS v4: []

CVE-ID: CVE-2016-8635

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

Hubert Kario discovered that NSS incorrectly handled Diffie Hellman client key exchanges. A remote attacker could possibly use this flaw to perform a small subgroup confinement attack and recover private keys.

Oracle VM Server for x86
Oracle Linux
Ubuntu
FlashSystem 900 9840-AE2 and 9843-AE2
FlashSystem 840 9840-AE1 & 9843-AE1
IBM FlashSystem V9000
IBM Storwize V3500
IBM Storwize V7000
IBM Storwize V5000
IBM Storwize V3700

IBM FlashSystem V9000 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V3500 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V7000 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V5000 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V3700 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0

• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

• Ubuntu update for NSS
• Multiple vulnerabilities in IBM FlashSystem models 840 and 900
• Multiple vulnerabilities in SAN Volume Controller, Storwize family and FlashSystem V9000 products