ALT-BU-2019-4098-3
Branch sisyphus update bulletin.
Package kernel-image-un-def updated to version 5.3.14-alt1 for branch sisyphus in task 241994.
Closed vulnerabilities
Modified: 2024-06-18
BDU:2019-03219
Уязвимость драйвера drivers/net/wireless/ath/ath10k/usb.c ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-06-18
BDU:2020-00195
Уязвимость драйвера дисплея (drivers/media/platform/vivid) ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-01-29
BDU:2020-00284
Уязвимость функции vcs_write (drivers/tty/vt/vc_screen.c) ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии
Modified: 2024-09-16
BDU:2020-02944
Уязвимость компонентов arch/powerpc/kernel/entry_64.S и arch/powerpc/kernel/security.c ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к информации
Modified: 2024-11-21
CVE-2019-15099
drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
- https://lore.kernel.org/linux-wireless/20190804003101.11541-1-benquike%40gmail.com/T/#u
- https://security.netapp.com/advisory/ntap-20190905-0002/
- https://support.f5.com/csp/article/K76295179
- https://support.f5.com/csp/article/K76295179?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4258-1/
- https://usn.ubuntu.com/4284-1/
- https://usn.ubuntu.com/4287-1/
- https://usn.ubuntu.com/4287-2/
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
- https://lore.kernel.org/linux-wireless/20190804003101.11541-1-benquike%40gmail.com/T/#u
- https://security.netapp.com/advisory/ntap-20190905-0002/
- https://support.f5.com/csp/article/K76295179
- https://support.f5.com/csp/article/K76295179?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4258-1/
- https://usn.ubuntu.com/4284-1/
- https://usn.ubuntu.com/4287-1/
- https://usn.ubuntu.com/4287-2/
Modified: 2024-11-21
CVE-2019-18660
The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
- http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- http://www.openwall.com/lists/oss-security/2019/11/27/1
- https://access.redhat.com/errata/RHSA-2020:0174
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.1
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYIFGYEDQXP5DVJQQUARQRK2PXKBKQGY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWWOOJKZ4NQYN4RMFIVJ3ZIXKJJI3MKP/
- https://seclists.org/bugtraq/2020/Jan/10
- https://security.netapp.com/advisory/ntap-20200103-0001/
- https://usn.ubuntu.com/4225-1/
- https://usn.ubuntu.com/4225-2/
- https://usn.ubuntu.com/4226-1/
- https://usn.ubuntu.com/4227-1/
- https://usn.ubuntu.com/4227-2/
- https://usn.ubuntu.com/4228-1/
- https://usn.ubuntu.com/4228-2/
- https://www.openwall.com/lists/oss-security/2019/11/27/1
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
- http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- http://www.openwall.com/lists/oss-security/2019/11/27/1
- https://access.redhat.com/errata/RHSA-2020:0174
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.1
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYIFGYEDQXP5DVJQQUARQRK2PXKBKQGY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWWOOJKZ4NQYN4RMFIVJ3ZIXKJJI3MKP/
- https://seclists.org/bugtraq/2020/Jan/10
- https://security.netapp.com/advisory/ntap-20200103-0001/
- https://usn.ubuntu.com/4225-1/
- https://usn.ubuntu.com/4225-2/
- https://usn.ubuntu.com/4226-1/
- https://usn.ubuntu.com/4227-1/
- https://usn.ubuntu.com/4227-2/
- https://usn.ubuntu.com/4228-1/
- https://usn.ubuntu.com/4228-2/
- https://www.openwall.com/lists/oss-security/2019/11/27/1
Modified: 2024-11-21
CVE-2019-18683
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
- http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- http://www.openwall.com/lists/oss-security/2019/11/05/1
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
- https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov%40linux.com/
- https://seclists.org/bugtraq/2020/Jan/10
- https://security.netapp.com/advisory/ntap-20191205-0001/
- https://usn.ubuntu.com/4254-1/
- https://usn.ubuntu.com/4254-2/
- https://usn.ubuntu.com/4258-1/
- https://usn.ubuntu.com/4284-1/
- https://usn.ubuntu.com/4287-1/
- https://usn.ubuntu.com/4287-2/
- https://www.openwall.com/lists/oss-security/2019/11/02/1
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
- http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- http://www.openwall.com/lists/oss-security/2019/11/05/1
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
- https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov%40linux.com/
- https://seclists.org/bugtraq/2020/Jan/10
- https://security.netapp.com/advisory/ntap-20191205-0001/
- https://usn.ubuntu.com/4254-1/
- https://usn.ubuntu.com/4254-2/
- https://usn.ubuntu.com/4258-1/
- https://usn.ubuntu.com/4284-1/
- https://usn.ubuntu.com/4287-1/
- https://usn.ubuntu.com/4287-2/
- https://www.openwall.com/lists/oss-security/2019/11/02/1
Modified: 2024-11-21
CVE-2019-19252
vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.
- https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-testing&id=0c9acb1af77a3cb8707e43f45b72c95266903cee
- https://lore.kernel.org/lkml/c30fc539-68a8-65d7-226c-6f8e6fd8bdfb%40suse.com/
- https://security.netapp.com/advisory/ntap-20200103-0001/
- https://usn.ubuntu.com/4258-1/
- https://usn.ubuntu.com/4284-1/
- https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-testing&id=0c9acb1af77a3cb8707e43f45b72c95266903cee
- https://lore.kernel.org/lkml/c30fc539-68a8-65d7-226c-6f8e6fd8bdfb%40suse.com/
- https://security.netapp.com/advisory/ntap-20200103-0001/
- https://usn.ubuntu.com/4258-1/
- https://usn.ubuntu.com/4284-1/
Closed bugs
Зависит от fonts-ttf-liberation