<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
<generator>
<oval:product_name>Oracle Errata System</oval:product_name>
<oval:product_version>Oracle Linux</oval:product_version>
<oval:schema_version>5.11</oval:schema_version>
<oval:timestamp>2024-09-21T18:49:44</oval:timestamp>
</generator>
<definitions>
<definition id="oval:com.oracle.elsa:def:20152155" version="501" class="patch">
<metadata>
<title>
ELSA-2015-2155:  file security and bug fix update (MODERATE)
</title>
<affected family="unix">
<platform>Oracle Linux 7</platform>

</affected>
<reference source="elsa" ref_id="ELSA-2015-2155" ref_url="https://linux.oracle.com/errata/ELSA-2015-2155.html"/>
<reference source="CVE" ref_id="CVE-2014-0237" ref_url="https://linux.oracle.com/cve/CVE-2014-0237.html"/>
<reference source="CVE" ref_id="CVE-2014-3478" ref_url="https://linux.oracle.com/cve/CVE-2014-3478.html"/>
<reference source="CVE" ref_id="CVE-2014-3587" ref_url="https://linux.oracle.com/cve/CVE-2014-3587.html"/>
<reference source="CVE" ref_id="CVE-2014-3710" ref_url="https://linux.oracle.com/cve/CVE-2014-3710.html"/>
<reference source="CVE" ref_id="CVE-2014-8117" ref_url="https://linux.oracle.com/cve/CVE-2014-8117.html"/>
<reference source="CVE" ref_id="CVE-2014-3487" ref_url="https://linux.oracle.com/cve/CVE-2014-3487.html"/>
<reference source="CVE" ref_id="CVE-2014-9653" ref_url="https://linux.oracle.com/cve/CVE-2014-9653.html"/>
<reference source="CVE" ref_id="CVE-2014-3479" ref_url="https://linux.oracle.com/cve/CVE-2014-3479.html"/>
<reference source="CVE" ref_id="CVE-2014-0207" ref_url="https://linux.oracle.com/cve/CVE-2014-0207.html"/>
<reference source="CVE" ref_id="CVE-2014-8116" ref_url="https://linux.oracle.com/cve/CVE-2014-8116.html"/>
<reference source="CVE" ref_id="CVE-2014-9652" ref_url="https://linux.oracle.com/cve/CVE-2014-9652.html"/>
<reference source="CVE" ref_id="CVE-2014-3538" ref_url="https://linux.oracle.com/cve/CVE-2014-3538.html"/>
<reference source="CVE" ref_id="CVE-2014-0238" ref_url="https://linux.oracle.com/cve/CVE-2014-0238.html"/>
<reference source="CVE" ref_id="CVE-2014-3480" ref_url="https://linux.oracle.com/cve/CVE-2014-3480.html"/>

<description>
[5.11-31]
- fix #1255396 - Make the build ID output consistent with other tools

[5.11-30]
- fix CVE-2014-8116 - bump the acceptable ELF program headers count to 2048

[5.11-29]
- fix #839229 - fix detection of version of XML files

[5.11-28]
- fix #839229 - fix detection of version of XML files

[5.11-27]
- fix CVE-2014-0207 - cdf_read_short_sector insufficient boundary check
- fix CVE-2014-0237 - cdf_unpack_summary_info() excessive looping DoS
- fix CVE-2014-0238 - CDF property info parsing nelements infinite loop
- fix CVE-2014-3478 - mconvert incorrect handling of truncated pascal string
- fix CVE-2014-3479 - fix extensive backtracking in regular expression
- fix CVE-2014-3480 - cdf_count_chain insufficient boundary check
- fix CVE-2014-3487 - cdf_read_property_info insufficient boundary check
- fix CVE-2014-3538 - unrestricted regular expression matching
- fix CVE-2014-3587 - fix cdf_read_property_info
- fix CVE-2014-3710 - out-of-bounds read in elf note headers
- fix CVE-2014-8116 - multiple denial of service issues (resource consumption)
- fix CVE-2014-8117 - denial of service issue (resource consumption)
- fix CVE-2014-9652 - out of bounds read in mconvert()
- fix CVE-2014-9653 - malformed elf file causes access to uninitialized memory

[5.11-26]
- fix #1080452 - remove .orig files from magic directory

[5.11-25]
- fix #1224667, #1224668 - show additional info for Linux swap files

[5.11-24]
- fix #1064268 - fix stray return -1

[5.11-23]
- fix #1094648 - improve Minix detection pattern to fix false positives
- fix #1161912 - trim white-spaces during ISO9660 detection
- fix #1157850 - fix detection of ppc64le ELF binaries
- fix #1161911 - display 'from' field on 32bit ppc core
- fix #1064167 - revert MAXMIME patch
- fix #1064268 - detect Dwarf debuginfo as 'not stripped'
- fix #1082689 - fix invalid read when matched pattern is the last one tried
- fix #1080362 - remove deadcode and OFFSET_OOB redefinition

[5.11-22]
- fix #1067688 - add support for aarch64 ELF binaries
</description>
<!--
 ~~~~~~~~~~~~~~~~~~~~   advisory details   ~~~~~~~~~~~~~~~~~~~ 
-->
<advisory>
<severity>MODERATE</severity>
<rights>Copyright 2015 Oracle, Inc.</rights>
<issued date="2015-11-23"/>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-0237.html" public="20140529">CVE-2014-0237</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-3478.html" public="20140627">CVE-2014-3478</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-3587.html" public="20140821">CVE-2014-3587</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-3710.html" public="20141022">CVE-2014-3710</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-8117.html" public="20141216">CVE-2014-8117</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-3487.html" public="20140627">CVE-2014-3487</cve>
<cve cvss2="3.3/AV:L/AC:M/Au:N/C:P/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-9653.html" public="20141216">CVE-2014-9653</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-3479.html" public="20140627">CVE-2014-3479</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-0207.html" public="20140627">CVE-2014-0207</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-8116.html" public="20141216">CVE-2014-8116</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:P/I:N/A:N" href="https://linux.oracle.com/cve/CVE-2014-9652.html" public="20141111">CVE-2014-9652</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-3538.html" public="20140627">CVE-2014-3538</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-0238.html" public="20140529">CVE-2014-0238</cve>
<cve cvss2="4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P" href="https://linux.oracle.com/cve/CVE-2014-3480.html" public="20140627">CVE-2014-3480</cve>

<affected_cpe_list>
<cpe>cpe:/a:oracle:linux:7:2:base</cpe>
<cpe>cpe:/a:oracle:linux:7::optional_archive</cpe>
<cpe>cpe:/a:oracle:linux:7::latest_archive</cpe>
</affected_cpe_list>
</advisory>
</metadata>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20152155001" comment="Oracle Linux 7 is installed"/>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20152155002" comment="Oracle Linux arch is x86_64"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20152155003" comment="file is earlier than 0:5.11-31.el7"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20152155004" comment="file is signed with the Oracle Linux 7 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20152155005" comment="file-devel is earlier than 0:5.11-31.el7"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20152155006" comment="file-devel is signed with the Oracle Linux 7 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20152155007" comment="file-libs is earlier than 0:5.11-31.el7"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20152155008" comment="file-libs is signed with the Oracle Linux 7 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20152155009" comment="file-static is earlier than 0:5.11-31.el7"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20152155010" comment="file-static is signed with the Oracle Linux 7 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:20152155011" comment="python-magic is earlier than 0:5.11-31.el7"/>
<criterion test_ref="oval:com.oracle.elsa:tst:20152155012" comment="python-magic is signed with the Oracle Linux 7 key"/>
</criteria>
</criteria>
</criteria>
</criteria>

</definition>
</definitions>
<!--
 ~~~~~~~~~~~~~~~~~~~~~   rpminfo tests   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<tests>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155001"  version="501" comment="Oracle Linux 7 is installed" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155001" />
<state state_ref="oval:com.oracle.elsa:ste:20152155002" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155002"  version="501" comment="Oracle Linux arch is x86_64" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155001" />
<state state_ref="oval:com.oracle.elsa:ste:20152155003" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155003"  version="501" comment="file is earlier than 0:5.11-31.el7" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155002" />
<state state_ref="oval:com.oracle.elsa:ste:20152155004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155004"  version="501" comment="file is signed with the Oracle Linux 7 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155002" />
<state state_ref="oval:com.oracle.elsa:ste:20152155001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155005"  version="501" comment="file-devel is earlier than 0:5.11-31.el7" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155003" />
<state state_ref="oval:com.oracle.elsa:ste:20152155004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155006"  version="501" comment="file-devel is signed with the Oracle Linux 7 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155003" />
<state state_ref="oval:com.oracle.elsa:ste:20152155001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155007"  version="501" comment="file-libs is earlier than 0:5.11-31.el7" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155004" />
<state state_ref="oval:com.oracle.elsa:ste:20152155004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155008"  version="501" comment="file-libs is signed with the Oracle Linux 7 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155004" />
<state state_ref="oval:com.oracle.elsa:ste:20152155001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155009"  version="501" comment="file-static is earlier than 0:5.11-31.el7" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155005" />
<state state_ref="oval:com.oracle.elsa:ste:20152155004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155010"  version="501" comment="file-static is signed with the Oracle Linux 7 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155005" />
<state state_ref="oval:com.oracle.elsa:ste:20152155001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155011"  version="501" comment="python-magic is earlier than 0:5.11-31.el7" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155006" />
<state state_ref="oval:com.oracle.elsa:ste:20152155004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:20152155012"  version="501" comment="python-magic is signed with the Oracle Linux 7 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:20152155006" />
<state state_ref="oval:com.oracle.elsa:ste:20152155001" />
</rpminfo_test>

</tests>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo objects   ~~~~~~~~~~~~~~~~~~~~ 
-->
<objects>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20152155003" version="501">
<name>file-devel</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20152155005" version="501">
<name>file-static</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20152155001" version="501">
<name>oraclelinux-release</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20152155004" version="501">
<name>file-libs</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20152155002" version="501">
<name>file</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:20152155006" version="501">
<name>python-magic</name>
</rpminfo_object>

</objects>
<states>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo states   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20152155001" version="501">
<signature_keyid operation="equals">72f97b74ec551f03</signature_keyid>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20152155002" version="501">
<version operation="pattern match">^7</version>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20152155003" version="501">
<arch operation="pattern match">x86_64</arch>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:20152155004" version="501">
<evr datatype="evr_string" operation="less than">0:5.11-31.el7</evr>
</rpminfo_state>

</states>
</oval_definitions>
