NVD脆弱性詳細

CVE-2015-3195

概要	The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
公表日	2015年12月7日5:59
登録日	2021年1月26日10:40
最終更新日	2024年11月21日11:28

CVSS3.1 : MEDIUM
スコア	5.3
ベクター	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低

CVSS2.0 : MEDIUM
スコア	5.0
ベクター	AV:N/AC:L/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:o:apple:mac_os_x::::::::					10.11.4

構成2	以上	以下	より上	未満
cpe:2.3:a:oracle:sun_ray_software:11.1:::::::*
cpe:2.3:a:oracle:transportation_management:6.1:::::::*
cpe:2.3:a:oracle:life_sciences_data_hub:2.1:::::::*
cpe:2.3:a:oracle:transportation_management:6.2:::::::*
cpe:2.3:a:oracle:api_gateway:11.1.2.3.0:::::::*
cpe:2.3:a:oracle:exalogic_infrastructure:1.0:::::::*
cpe:2.3:o:oracle:solaris:11.3:::::::*
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:::::::*
cpe:2.3:a:oracle:exalogic_infrastructure:2.0:::::::*
cpe:2.3:o:oracle:solaris:10:::::::*
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.0:::::::*
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:::::::*
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.1:::::::*
cpe:2.3:a:oracle:vm_virtualbox::::::::	5.0.0			5.0.14
cpe:2.3:o:oracle:linux:5:-::::::
cpe:2.3:a:oracle:vm_server:3.2::::::x86:
cpe:2.3:o:oracle:linux:6:-::::::
cpe:2.3:o:oracle:linux:7:-::::::
cpe:2.3:a:oracle:vm_virtualbox::::::::				4.3.36
cpe:2.3:a:oracle:http_server:11.5.10.2:::::::*
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware::::::::	3.0	4.0.4

構成3	以上	以下	より上	未満
cpe:2.3:a:openssl:openssl::::::::				0.9.8zh
cpe:2.3:a:openssl:openssl::::::::	1.0.0			1.0.0t
cpe:2.3:a:openssl:openssl::::::::	1.0.1			1.0.1q
cpe:2.3:a:openssl:openssl::::::::	1.0.2			1.0.2e

構成4	以上	以下	より上	未満
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:::::::*

構成5	以上	以下	より上	未満
cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::

構成6	以上	以下	より上	未満
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:7.0:::::::*

構成7	以上	以下	より上	未満
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:::ltss:::*
cpe:2.3:o:opensuse:leap:42.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*

構成8		以上	以下	より上	未満
cpe:2.3:o:fedoraproject:fedora:22:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://fortiguard.com/advisory/openssl-advisory-december-2015	Broken Link
2	http://fortiguard.com/advisory/openssl-advisory-december-2015	Broken Link
3	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733	Third Party Advisory
4	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733	Third Party Advisory
5	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759	Third Party Advisory
6	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759	Third Party Advisory
7	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761	Third Party Advisory
8	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761	Third Party Advisory
9	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	Mailing List Third Party Advisory
10	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	Mailing List Third Party Advisory
11	http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html	Third Party Advisory
12	http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html	Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html	Mailing List Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html	Mailing List Third Party Advisory
16	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html	Mailing List Third Party Advisory
17	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html	Mailing List Third Party Advisory
18	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html	Mailing List Third Party Advisory
19	http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html	Mailing List Third Party Advisory
20	http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html	Mailing List Third Party Advisory
21	http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html	Mailing List Third Party Advisory
22	http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html	Mailing List Third Party Advisory
23	http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html	Mailing List Third Party Advisory
24	http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html	Mailing List Third Party Advisory
25	http://lists.opensuse.org/opensuse-updates/2015-12/msg00103.html	Mailing List Third Party Advisory
26	http://lists.opensuse.org/opensuse-updates/2015-12/msg00103.html	Mailing List Third Party Advisory
27	http://marc.info/?l=bugtraq&m=145382583417444&w=2	Mailing List Third Party Advisory
28	http://marc.info/?l=bugtraq&m=145382583417444&w=2	Mailing List Third Party Advisory
29	http://openssl.org/news/secadv/20151203.txt	Vendor Advisory
30	http://openssl.org/news/secadv/20151203.txt	Vendor Advisory
31	http://rhn.redhat.com/errata/RHSA-2015-2616.html	Third Party Advisory
32	http://rhn.redhat.com/errata/RHSA-2015-2616.html	Third Party Advisory
33	http://rhn.redhat.com/errata/RHSA-2015-2617.html	Third Party Advisory
34	http://rhn.redhat.com/errata/RHSA-2015-2617.html	Third Party Advisory
35	http://rhn.redhat.com/errata/RHSA-2016-2056.html	Broken Link
36	http://rhn.redhat.com/errata/RHSA-2016-2056.html	Broken Link
37	http://rhn.redhat.com/errata/RHSA-2016-2957.html	Third Party Advisory
38	http://rhn.redhat.com/errata/RHSA-2016-2957.html	Third Party Advisory
39	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl	Third Party Advisory
40	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl	Third Party Advisory
41	http://www.debian.org/security/2015/dsa-3413	Third Party Advisory
42	http://www.debian.org/security/2015/dsa-3413	Third Party Advisory
43	http://www.fortiguard.com/advisory/openssl-advisory-december-2015	Broken Link
44	http://www.fortiguard.com/advisory/openssl-advisory-december-2015	Broken Link
45	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html	Third Party Advisory
46	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html	Third Party Advisory
47	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	Third Party Advisory
48	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	Third Party Advisory
49	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	Third Party Advisory
50	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	Third Party Advisory
51	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Third Party Advisory
52	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Third Party Advisory
53	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	Third Party Advisory
54	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	Third Party Advisory
55	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	Third Party Advisory
56	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	Third Party Advisory
57	http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html	Third Party Advisory
58	http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html	Third Party Advisory
59	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	Third Party Advisory
60	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	Third Party Advisory
61	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	Third Party Advisory
62	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	Third Party Advisory
63	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	Third Party Advisory
64	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	Third Party Advisory
65	http://www.securityfocus.com/bid/78626	Third Party Advisory VDB Entry
66	http://www.securityfocus.com/bid/78626	Third Party Advisory VDB Entry
67	http://www.securityfocus.com/bid/91787	Third Party Advisory VDB Entry
68	http://www.securityfocus.com/bid/91787	Third Party Advisory VDB Entry
69	http://www.securitytracker.com/id/1034294	Third Party Advisory VDB Entry
70	http://www.securitytracker.com/id/1034294	Third Party Advisory VDB Entry
71	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583	Third Party Advisory
72	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583	Third Party Advisory
73	http://www.ubuntu.com/usn/USN-2830-1	Third Party Advisory
74	http://www.ubuntu.com/usn/USN-2830-1	Third Party Advisory
75	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
76	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
77	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=cc598f321fbac9c04da5766243ed55d55948637d
78	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=cc598f321fbac9c04da5766243ed55d55948637d
79	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173	Third Party Advisory
80	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173	Third Party Advisory
81	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017	Third Party Advisory
82	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017	Third Party Advisory
83	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085	Third Party Advisory
84	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085	Third Party Advisory
85	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888	Third Party Advisory
86	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888	Third Party Advisory
87	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380	Third Party Advisory
88	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380	Third Party Advisory
89	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322	Third Party Advisory
90	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322	Third Party Advisory
91	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100	Third Party Advisory
92	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100	Third Party Advisory
93	https://support.apple.com/HT206167	Third Party Advisory
94	https://support.apple.com/HT206167	Third Party Advisory

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN脆弱性情報

OpenSSL の crypto/asn1/tasn_dec.c の ASN1_TFLG_COMBINE の実装におけるプロセスメモリから重要な情報を取得される脆弱性

タイトル	OpenSSL の crypto/asn1/tasn_dec.c の ASN1_TFLG_COMBINE の実装におけるプロセスメモリから重要な情報を取得される脆弱性
概要	OpenSSL の crypto/asn1/tasn_dec.c の ASN1_TFLG_COMBINE の実装は、不正な形式の X509_ATTRIBUTE データによるエラーを誤って処理するため、プロセスメモリから重要な情報を取得される脆弱性が存在します。
想定される影響	第三者により、PKCS#7 または CMS アプリケーションのデーコードの失敗を誘発されることで、プロセスメモリから重要な情報を取得される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2015年12月3日0:00
登録日	2015年12月8日17:50
最終更新日	2016年11月22日15:48

影響を受けるシステム

オラクル

40G 10G 72/64 Ethernet Switch 2.0.0

JD Edwards EnterpriseOne Tools 9.2.0.5

MySQL 5.6.28 およびそれ以前

MySQL 5.7.10 およびそれ以前

Oracle API Gateway 11.1.2.3.0

Oracle API Gateway 11.1.2.4.0

Oracle Communications Applications の Oracle Enterprise Session Border Controller Ecz7.3m1p4 およびそれ以前

Oracle Communications Network Charging and Control 4.4.1.5.0

Oracle Communications Network Charging and Control 5.0.0.1.0

Oracle Communications Network Charging and Control 5.0.0.2.0

Oracle Communications Network Charging and Control 5.0.1.0.0

Oracle Communications Network Charging and Control 5.0.2.0.0

Oracle E-Business Suite 11.5.10.2

Oracle Enterprise Manager Ops Center 12.1.4

Oracle Enterprise Manager Ops Center 12.2.2

Oracle Enterprise Manager Ops Center 12.3.2

Oracle Exalogic Infrastructure 1.0

Oracle Exalogic Infrastructure 2.0

Oracle Life Sciences Data Hub 2.1

Oracle Switch ES1-24 1.3

Oracle Transportation Management 6.1

Oracle Transportation Management 6.2

Oracle VM VirtualBox 4.3.36 未満

Oracle VM VirtualBox 5.0.14 未満

PeopleSoft Enterprise PeopleTools 8.53

PeopleSoft Enterprise PeopleTools 8.54

PeopleSoft Enterprise PeopleTools 8.55

Primavera P6 Enterprise Project Portfolio Management 15.1

Primavera P6 Enterprise Project Portfolio Management 15.2

Primavera P6 Enterprise Project Portfolio Management 8.3

Primavera P6 Enterprise Project Portfolio Management 8.4

Sun Blade 6000 Ethernet Switched NEM 24P 10GE 1.2

Sun Network 10GE Switch 72P 1.2

Sun Ray Software 11.1

OpenSSL Project

OpenSSL 0.9.8zh 未満

OpenSSL 1.0.0t 未満の 1.0.0

OpenSSL 1.0.1q 未満の 1.0.1

OpenSSL 1.0.2e 未満の 1.0.2

アップル

Apple Mac OS X 10.11 から 10.11.3

ヒューレット・パッカード・エンタープライズ

HPE Insight Control

HPE Insight Control サーバープロビジョニング

HPE Matrix Operating Environment

HPE Server Migration Pack

HPE Systems Insight Manager

HPE Version Control Repository Manager

System Management Homepage

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-3195	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3195
National Vulnerability Database (NVD)
2	CVE-2015-3195	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3195

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	名前	URL
Apple Mailing Lists
1	APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Apple Security Updates
2	HT206167	https://support.apple.com/en-us/HT206167
Apple セキュリティアップデート
3	HT206167	https://support.apple.com/ja-jp/HT206167
HPE Security Bulletin
4	HPSBMU03590	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05131085
5	HPSBMU03611	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150888
6	HPSBMU03612	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05158380
OpenSSL
7	OpenSSL 0.9.8 Series Release Notes	https://www.openssl.org/news/openssl-0.9.8-notes.html
8	OpenSSL 1.0.0 Series Release Notes	https://www.openssl.org/news/openssl-1.0.0-notes.html
9	OpenSSL 1.0.1 Series Release Notes	https://www.openssl.org/news/openssl-1.0.1-notes.html
10	OpenSSL 1.0.2 Series Release Notes	https://www.openssl.org/news/openssl-1.0.2-notes.html
11	Release Strategy	https://www.openssl.org/policies/releasestrat.html
OpenSSL Project
12	Fix leak with ASN.1 combine.	https://git.openssl.org/?p=openssl.git;a=commit;h=cc598f321fbac9c04da5766243ed55d55948637d
OpenSSL Security Advisory
13	X509_ATTRIBUTE memory leak (CVE-2015-3195)	http://openssl.org/news/secadv/20151203.txt
Oracle Critical Patch Update
14	Oracle Critical Patch Update Advisory - April 2016	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
15	Oracle Critical Patch Update Advisory - January 2016	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
16	Oracle Critical Patch Update Advisory - July 2016	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
17	Oracle Critical Patch Update Advisory - October 2016	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
18	Oracle Critical Patch Update CVSS V2 Risk Matrices - April 2016	http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html
19	Text Form of Oracle Critical Patch Update - April 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuapr2016verbose-2881709.html
20	Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2016verbose-2367956.html
21	Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2016verbose-2881721.html
22	Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices	http://www.oracle.com/technetwork/security-advisory/cpuoct2016verbose-2881725.html
Oracle Technology Network
23	Oracle Linux Bulletin - October 2015	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
24	Oracle Solaris Third Party Bulletin - January 2016	http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
25	Oracle VM Server for x86 Bulletin - July 2016	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
SECURITY BLOG
26	April 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/april_2016_critical_patch_update
27	January 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2016_critical_patch_update
28	July 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2016_critical_patch_update
29	October 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2016_critical_patch_update
Turbolinux Security Advisory
30	TLSA-2015-20	http://www.turbolinux.co.jp/security/2015/TLSA-2015-20j.html

その他

No	名前	URL
JVN
1	JVNVU#95113540	http://jvn.jp/vu/JVNVU95113540/
2	JVNVU#97668313	http://jvn.jp/vu/JVNVU97668313

変更履歴

No	変更内容	変更日
0	[2015年12月08日] 掲載 [2016年01月19日] ベンダ情報：ターボリナックス (TLSA-2015-20) を追加 [2016年01月28日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices) を追加ベンダ情報：オラクル (January 2016 Critical Patch Update Released) を追加ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - January 2016) を追加 [2016年03月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT206167) を追加ベンダ情報：アップル (APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002) を追加参考情報：JVN (JVNVU#97668313) を追加 [2016年05月31日] CVSS による深刻度：内容を更新影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update CVSS V2 Risk Matrices - April 2016) を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - April 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - April 2016 Risk Matrices) を追加ベンダ情報：オラクル (April 2016 Critical Patch Update Released) を追加 [2016年09月30日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices) を追加ベンダ情報：オラクル (July 2016 Critical Patch Update Released) を追加ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBMU03612) を追加ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBMU03611) を追加ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBMU03590) を追加 [2016年11月22日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices) を追加ベンダ情報：オラクル (October 2016 Critical Patch Update Released) を追加ベンダ情報：オラクル (Oracle VM Server for x86 Bulletin - July 2016) を追加ベンダ情報：オラクル (Oracle Linux Bulletin - October 2015) を追加	2018年2月17日10:37

構成2	以上	以下	より上	未満
cpe:2.3:a:oracle:sun_ray_software:11.1:::::::*
cpe:2.3:a:oracle:transportation_management:6.1:::::::*
cpe:2.3:a:oracle:life_sciences_data_hub:2.1:::::::*
cpe:2.3:a:oracle:transportation_management:6.2:::::::*
cpe:2.3:a:oracle:api_gateway:11.1.2.3.0:::::::*
cpe:2.3:a:oracle:exalogic_infrastructure:1.0:::::::*
cpe:2.3:o:oracle:solaris:11.3:::::::*
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:::::::*
cpe:2.3:a:oracle:exalogic_infrastructure:2.0:::::::*
cpe:2.3:o:oracle:solaris:10:::::::*
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.0:::::::*
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:::::::*
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.1:::::::*
cpe:2.3:a:oracle:vm_virtualbox::::::::	5.0.0			5.0.14
cpe:2.3:o:oracle:linux:5:-::::::
cpe:2.3:a:oracle:vm_server:3.2::::::x86:
cpe:2.3:o:oracle:linux:6:-::::::
cpe:2.3:o:oracle:linux:7:-::::::
cpe:2.3:a:oracle:vm_virtualbox::::::::				4.3.36
cpe:2.3:a:oracle:http_server:11.5.10.2:::::::*
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware::::::::	3.0	4.0.4

構成4	以上	以下	より上	未満
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:::::::*