ALT-BU-2018-3023-1
Branch p8 update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2011-2207
dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate.
- https://access.redhat.com/security/cve/cve-2011-2207
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627377
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2207
- https://security-tracker.debian.org/tracker/CVE-2011-2207
- [oss-security] 20110615 Re: CVE Request / Discussion -- dirmngr -- Improper dealing with blocking system calls, when verifying a certificate
- https://access.redhat.com/security/cve/cve-2011-2207
- [oss-security] 20110615 Re: CVE Request / Discussion -- dirmngr -- Improper dealing with blocking system calls, when verifying a certificate
- https://security-tracker.debian.org/tracker/CVE-2011-2207
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2207
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627377
Modified: 2024-11-21
CVE-2015-1606
The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.
- http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648
- http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648
- http://www.debian.org/security/2015/dsa-3184
- http://www.debian.org/security/2015/dsa-3184
- http://www.openwall.com/lists/oss-security/2015/02/13/14
- http://www.openwall.com/lists/oss-security/2015/02/13/14
- http://www.openwall.com/lists/oss-security/2015/02/14/6
- http://www.openwall.com/lists/oss-security/2015/02/14/6
- http://www.securitytracker.com/id/1031876
- http://www.securitytracker.com/id/1031876
- https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html
- https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html
Package kernel-image-un-def updated to version 4.14.15-alt0.M80P.1 for branch p8 in task 198472.
Closed vulnerabilities
BDU:2019-03625
Уязвимость функции pcpu_embed_first_chunk() ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к информации
Modified: 2024-11-21
CVE-2017-18551
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
- openSUSE-SU-2019:2173
- openSUSE-SU-2019:2173
- openSUSE-SU-2019:2181
- openSUSE-SU-2019:2181
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.15
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.15
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89c6efa61f5709327ecfa24bff18e57a4e80c7fa
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89c6efa61f5709327ecfa24bff18e57a4e80c7fa
- https://support.f5.com/csp/article/K48073202?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K48073202?utm_source=f5support&%3Butm_medium=RSS
Modified: 2024-11-21
CVE-2018-5953
The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "software IO TLB" printk call.
- 105045
- 105045
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7d63fb3af87aa67aa7d24466e792f9d7c57d8e79
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7d63fb3af87aa67aa7d24466e792f9d7c57d8e79
- https://github.com/johnsonwangqize/cve-linux/blob/master/%20CVE-2018-5953.md
- https://github.com/johnsonwangqize/cve-linux/blob/master/%20CVE-2018-5953.md
- [debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update
- [debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update
- [debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update
- [debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update
Modified: 2024-11-21
CVE-2018-5995
The pcpu_embed_first_chunk function in mm/percpu.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "pages/cpu" printk call.
- 105049
- 105049
- https://github.com/johnsonwangqize/cve-linux/blob/master/CVE-2018-5995.md
- https://github.com/johnsonwangqize/cve-linux/blob/master/CVE-2018-5995.md
- [debian-lts-announce] 20190528 [SECURITY] [DLA 1799-1] linux security update
- [debian-lts-announce] 20190528 [SECURITY] [DLA 1799-1] linux security update
- [debian-lts-announce] 20190528 [SECURITY] [DLA 1799-2] linux security update
- [debian-lts-announce] 20190528 [SECURITY] [DLA 1799-2] linux security update
- [debian-lts-announce] 20190814 [SECURITY] [DLA 1885-1] linux-4.9 security update
- [debian-lts-announce] 20190814 [SECURITY] [DLA 1885-1] linux-4.9 security update
- 20190813 [SECURITY] [DSA 4497-1] linux security update
- 20190813 [SECURITY] [DSA 4497-1] linux security update
- DSA-4497
- DSA-4497
Modified: 2024-11-21
CVE-2018-6927
The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value.
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fbe0e839d1e22d88810f3ee3e2f1479be4c0aa4a
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fbe0e839d1e22d88810f3ee3e2f1479be4c0aa4a
- 103023
- 103023
- RHSA-2018:0654
- RHSA-2018:0654
- RHSA-2018:0676
- RHSA-2018:0676
- RHSA-2018:1062
- RHSA-2018:1062
- https://github.com/torvalds/linux/commit/fbe0e839d1e22d88810f3ee3e2f1479be4c0aa4a
- https://github.com/torvalds/linux/commit/fbe0e839d1e22d88810f3ee3e2f1479be4c0aa4a
- [debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update
- [debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update
- USN-3619-1
- USN-3619-1
- USN-3619-2
- USN-3619-2
- USN-3697-1
- USN-3697-1
- USN-3697-2
- USN-3697-2
- USN-3698-1
- USN-3698-1
- USN-3698-2
- USN-3698-2
- DSA-4187
- DSA-4187
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.15
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.15
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-7650
In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.
Modified: 2024-11-21
CVE-2017-9868
In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.