ALT-BU-2014-2513-1
Branch t7 update bulletin.
Closed bugs
separate pkg for journalctl without systemd?
Package adobe-flash-player updated to version 11-alt23 for branch t7 in task 111646.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2013-5331
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified "type confusion," as exploited in the wild in December 2013.
Modified: 2024-11-21
CVE-2013-5332
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Package kernel-image-el-def updated to version 2.6.32-alt17 for branch t7 in task 111646.
Closed vulnerabilities
BDU:2014-00095
Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2013-6367
The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b963a22e6d1a266a67e9eecc88134713fd54775c
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b963a22e6d1a266a67e9eecc88134713fd54775c
- openSUSE-SU-2014:0204
- openSUSE-SU-2014:0204
- openSUSE-SU-2014:0205
- openSUSE-SU-2014:0205
- openSUSE-SU-2014:0247
- openSUSE-SU-2014:0247
- RHSA-2013:1801
- RHSA-2013:1801
- RHSA-2014:0163
- RHSA-2014:0163
- RHSA-2014:0284
- RHSA-2014:0284
- [oss-security] 20131212 Re: [vs-plain] kvm issues
- [oss-security] 20131212 Re: [vs-plain] kvm issues
- 64270
- 64270
- USN-2109-1
- USN-2109-1
- USN-2110-1
- USN-2110-1
- USN-2113-1
- USN-2113-1
- USN-2117-1
- USN-2117-1
- USN-2128-1
- USN-2128-1
- USN-2129-1
- USN-2129-1
- USN-2135-1
- USN-2135-1
- USN-2136-1
- USN-2136-1
- USN-2138-1
- USN-2138-1
- USN-2139-1
- USN-2139-1
- USN-2141-1
- USN-2141-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1032207
- https://bugzilla.redhat.com/show_bug.cgi?id=1032207
- https://github.com/torvalds/linux/commit/b963a22e6d1a266a67e9eecc88134713fd54775c
- https://github.com/torvalds/linux/commit/b963a22e6d1a266a67e9eecc88134713fd54775c
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.54
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.54
Modified: 2024-11-21
CVE-2013-6368
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fda4e2e85589191b123d31cdc21fd33ee70f50fd
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fda4e2e85589191b123d31cdc21fd33ee70f50fd
- openSUSE-SU-2014:0204
- openSUSE-SU-2014:0204
- openSUSE-SU-2014:0205
- openSUSE-SU-2014:0205
- openSUSE-SU-2014:0247
- openSUSE-SU-2014:0247
- RHSA-2013:1801
- RHSA-2013:1801
- RHSA-2014:0163
- RHSA-2014:0163
- RHSA-2014:0284
- RHSA-2014:0284
- [oss-security] 20131212 Re: [vs-plain] kvm issues
- [oss-security] 20131212 Re: [vs-plain] kvm issues
- 64291
- 64291
- USN-2113-1
- USN-2113-1
- USN-2117-1
- USN-2117-1
- USN-2133-1
- USN-2133-1
- USN-2134-1
- USN-2134-1
- USN-2135-1
- USN-2135-1
- USN-2136-1
- USN-2136-1
- USN-2138-1
- USN-2138-1
- USN-2139-1
- USN-2139-1
- USN-2141-1
- USN-2141-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1032210
- https://bugzilla.redhat.com/show_bug.cgi?id=1032210
- https://github.com/torvalds/linux/commit/fda4e2e85589191b123d31cdc21fd33ee70f50fd
- https://github.com/torvalds/linux/commit/fda4e2e85589191b123d31cdc21fd33ee70f50fd
Package kernel-image-ovz-el updated to version 2.6.32-alt109 for branch t7 in task 111646.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2013-2141
The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
- openSUSE-SU-2013:1971
- openSUSE-SU-2013:1971
- RHSA-2013:1801
- RHSA-2013:1801
- 55055
- 55055
- DSA-2766
- DSA-2766
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9
- MDVSA-2013:176
- MDVSA-2013:176
- [oss-security] 20130604 Re: CVE Request: kernel info leak in tkill/tgkill
- [oss-security] 20130604 Re: CVE Request: kernel info leak in tkill/tgkill
- USN-1899-1
- USN-1899-1
- USN-1900-1
- USN-1900-1
- https://bugzilla.redhat.com/show_bug.cgi?id=970873
- https://bugzilla.redhat.com/show_bug.cgi?id=970873
- https://github.com/torvalds/linux/commit/b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
- https://github.com/torvalds/linux/commit/b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
Modified: 2024-11-21
CVE-2013-4470
The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e93b7d748be887cd7639b113ba7d7ef792a7efb9
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e93b7d748be887cd7639b113ba7d7ef792a7efb9
- SUSE-SU-2014:0459
- SUSE-SU-2014:0459
- RHSA-2013:1801
- RHSA-2013:1801
- RHSA-2014:0100
- RHSA-2014:0100
- RHSA-2014:0284
- RHSA-2014:0284
- [oss-security] 20131025 Re: CVE request: Linux kernel: net: memory corruption with UDP_CORK and UFO
- [oss-security] 20131025 Re: CVE request: Linux kernel: net: memory corruption with UDP_CORK and UFO
- 63359
- 63359
- USN-2040-1
- USN-2040-1
- USN-2042-1
- USN-2042-1
- USN-2043-1
- USN-2043-1
- USN-2044-1
- USN-2044-1
- USN-2046-1
- USN-2046-1
- USN-2049-1
- USN-2049-1
- USN-2050-1
- USN-2050-1
- USN-2066-1
- USN-2066-1
- USN-2067-1
- USN-2067-1
- USN-2069-1
- USN-2069-1
- USN-2073-1
- USN-2073-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1023477
- https://bugzilla.redhat.com/show_bug.cgi?id=1023477
- https://github.com/torvalds/linux/commit/c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- https://github.com/torvalds/linux/commit/c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- https://github.com/torvalds/linux/commit/e93b7d748be887cd7639b113ba7d7ef792a7efb9
- https://github.com/torvalds/linux/commit/e93b7d748be887cd7639b113ba7d7ef792a7efb9
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.12.bz2
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.12.bz2