HIGH7.2
Уязвимость операционной системы Red Hat Linux, позволяющая злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CReferences
ALT-PU-2018-2814-2Package update kernel-image-std-pae in branch sisyphus
Severity:
Closed issues (22)
HIGH7.2
Уязвимость операционной системы Red Hat Linux, позволяющая злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CReferences
MEDIUM6.1
Уязвимость функции cdrom_ioctl_drive_status() операционных систем Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:HCVSS 2.0LOW 3.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:PReferences
HIGH8.8
Уязвимость программы для установки SSL сертификатов в стандартизированной инструментарии Linux Sblim-sfcb, связанная с неверным определением ссылки перед доступом к файлу, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
CVSS 3.xHIGH 8.8
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS 2.0MEDIUM 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CReferences
MEDIUM6.3
Уязвимость агента обновления Novell ZENworks Patch Management клиента обновления PatchLink, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
CVSS 3.xMEDIUM 6.3
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LCVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PReferences
MEDIUM6.3
Уязвимость функции sysstat.in утилиты для измерения и анализа производительности системы sysstat, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
CVSS 3.xMEDIUM 6.3
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LCVSS 2.0MEDIUM 4.4
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:P/A:PReferences
HIGH7.8
Уязвимость функции GetInstalledPackages менеджера установки Application Lifestyle Management, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании или оказать воздействие на целостность данных
CVSS 3.xHIGH 7.8
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CReferences
MEDIUM5.3
Уязвимость модуля modules/serverdensity_device.py системы управления конфигураций и удаленного выполнения операций SaltStack, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании или оказать воздействие на целостность данных
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LCVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PReferences
HIGH7.0
Уязвимость компонента consoleinst.sh менеджера установки Installation Manager IBM, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании или оказать воздействие на целостность данных
CVSS 3.xHIGH 7.0
CVSS:3.x/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS 2.0MEDIUM 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CReferences
HIGH7.2
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CReferences
- ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:76.tcsh-csh.asc
- ftp://patches.sgi.com/support/free/security/advisories/20011103-02-P
- http://archives.neohapsis.com/archives/bugtraq/2000-10/0418.html
- http://archives.neohapsis.com/archives/tru64/2002-q1/0009.html
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000350
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000354
- http://marc.info/?l=bugtraq&m=97561816504170&w=2
- http://www.calderasystems.com/support/security/advisories/CSSA-2000-042.0.txt
- http://www.calderasystems.com/support/security/advisories/CSSA-2000-043.0.txt
- http://www.debian.org/security/2000/20001111a
- http://www.kb.cert.org/vuls/id/10277
- http://www.linux-mandrake.com/en/security/MDKSA-2000-069.php3
- http://www.linux-mandrake.com/en/security/MDKSA-2000-075.php3
- http://www.redhat.com/support/errata/RHSA-2000-117.html
- http://www.redhat.com/support/errata/RHSA-2000-121.html
- http://www.securityfocus.com/archive/1/146657
- http://www.securityfocus.com/bid/1926
- http://www.securityfocus.com/bid/2006
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4047
- ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:76.tcsh-csh.asc
- ftp://patches.sgi.com/support/free/security/advisories/20011103-02-P
- http://archives.neohapsis.com/archives/bugtraq/2000-10/0418.html
- http://archives.neohapsis.com/archives/tru64/2002-q1/0009.html
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000350
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000354
- http://marc.info/?l=bugtraq&m=97561816504170&w=2
- http://www.calderasystems.com/support/security/advisories/CSSA-2000-042.0.txt
- http://www.calderasystems.com/support/security/advisories/CSSA-2000-043.0.txt
- http://www.debian.org/security/2000/20001111a
- http://www.kb.cert.org/vuls/id/10277
- http://www.linux-mandrake.com/en/security/MDKSA-2000-069.php3
- http://www.linux-mandrake.com/en/security/MDKSA-2000-075.php3
- http://www.redhat.com/support/errata/RHSA-2000-117.html
- http://www.redhat.com/support/errata/RHSA-2000-121.html
- http://www.securityfocus.com/archive/1/146657
- http://www.securityfocus.com/bid/1926
- http://www.securityfocus.com/bid/2006
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4047
MEDIUM4.4
The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code.
CVSS 2.0MEDIUM 4.4
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:P/A:PReferences
- http://osvdb.org/39709
- http://secunia.com/advisories/26527
- http://www.redhat.com/support/errata/RHSA-2011-1005.html
- http://www.securityfocus.com/bid/25380
- https://bugs.gentoo.org/show_bug.cgi?id=188808
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36045
- http://osvdb.org/39709
- http://secunia.com/advisories/26527
- http://www.redhat.com/support/errata/RHSA-2011-1005.html
- http://www.securityfocus.com/bid/25380
- https://bugs.gentoo.org/show_bug.cgi?id=188808
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36045
MEDIUM4.6
PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac (LUM) 6.2094 through 6.4102 and other products, allows local users to (1) truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script, and (2) execute arbitrary code via a symlink attack on the /tmp/plshutdown file used by the rebootTask script.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PReferences
- http://secunia.com/advisories/28657
- http://secunia.com/advisories/28665
- http://securityreason.com/securityalert/3599
- http://support.lumension.com/scripts/rightnow.cfg/php.exe/enduser/std_adp.php?p_faqid=527
- http://support.lumension.com/scripts/rightnow.cfg/php.exe/enduser/std_adp.php?p_faqid=528
- http://support.lumension.com/scripts/rightnow.cfg/php.exe/enduser/std_adp.php?p_faqid=530
- http://www.securityfocus.com/archive/1/487103/100/0/threaded
- http://www.securityfocus.com/bid/27458
- http://www.securitytracker.com/id?1019272
- http://www.vupen.com/english/advisories/2008/0426
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39956
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39958
- https://secure-support.novell.com/KanisaPlatform/Publishing/18/3908994_f.SAL_Public.html
- http://secunia.com/advisories/28657
- http://secunia.com/advisories/28665
- http://securityreason.com/securityalert/3599
- http://support.lumension.com/scripts/rightnow.cfg/php.exe/enduser/std_adp.php?p_faqid=527
- http://support.lumension.com/scripts/rightnow.cfg/php.exe/enduser/std_adp.php?p_faqid=528
- http://support.lumension.com/scripts/rightnow.cfg/php.exe/enduser/std_adp.php?p_faqid=530
- http://www.securityfocus.com/archive/1/487103/100/0/threaded
- http://www.securityfocus.com/bid/27458
- http://www.securitytracker.com/id?1019272
- http://www.vupen.com/english/advisories/2008/0426
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39956
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39958
- https://secure-support.novell.com/KanisaPlatform/Publishing/18/3908994_f.SAL_Public.html
MEDIUM6.9
The SSL certificate setup program (genSslCert.sh) in Standards Based Linux Instrumentation for Manageability (SBLIM) sblim-sfcb 1.3.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /var/tmp/key.pem, (2) /var/tmp/cert.pem, and (3) /var/tmp/ssl.cnf temporary files.
CVSS 2.0MEDIUM 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CReferences
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://osvdb.org/51783
- http://secunia.com/advisories/33795
- http://sourceforge.net/forum/forum.php?forum_id=874261
- http://sourceforge.net/tracker/index.php?func=detail&aid=2561165&group_id=128809&atid=712784
- http://www.securityfocus.com/bid/33583
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://osvdb.org/51783
- http://secunia.com/advisories/33795
- http://sourceforge.net/forum/forum.php?forum_id=874261
- http://sourceforge.net/tracker/index.php?func=detail&aid=2561165&group_id=128809&atid=712784
- http://www.securityfocus.com/bid/33583
MEDIUM4.6
The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gain privileges via (1) a Trojan horse /tmp/tmp.txt FIFO or (2) a symlink attack on /tmp/tmp.txt.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PReferences
- http://0a29.blogspot.com/2011/12/0a29-11-2-privilege-escalation.html
- http://secunia.com/advisories/47040
- http://www.securityfocus.com/archive/1/520783/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71698
- http://0a29.blogspot.com/2011/12/0a29-11-2-privilege-escalation.html
- http://secunia.com/advisories/47040
- http://www.securityfocus.com/archive/1/520783/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71698
MEDIUM5.3
modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LReferences
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1212784
- https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html
- https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1212784
- https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html
- https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c
HIGH7.0
consoleinst.sh in IBM Installation Manager before 1.7.4.4 and 1.8.x before 1.8.4 and Packaging Utility before 1.7.4.4 and 1.8.x before 1.8.4 allows local users to gain privileges via a Trojan horse program that is located in /tmp with a name based on a predicted PID value.
CVSS 2.0MEDIUM 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCRITICAL9.8
Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution.
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMEDIUM5.5
The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9de4ee40547fd315d4a0ed1dd15a2fa3559ad707
- http://www.securityfocus.com/bid/104154
- https://access.redhat.com/errata/RHSA-2018:2948
- https://access.redhat.com/errata/RHSA-2018:3083
- https://access.redhat.com/errata/RHSA-2018:3096
- https://github.com/torvalds/linux/commit/9de4ee40547fd315d4a0ed1dd15a2fa3559ad707
- https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html
- https://usn.ubuntu.com/3676-1/
- https://usn.ubuntu.com/3676-2/
- https://usn.ubuntu.com/3695-1/
- https://usn.ubuntu.com/3695-2/
- https://usn.ubuntu.com/3754-1/
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.6
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9de4ee40547fd315d4a0ed1dd15a2fa3559ad707
- http://www.securityfocus.com/bid/104154
- https://access.redhat.com/errata/RHSA-2018:2948
- https://access.redhat.com/errata/RHSA-2018:3083
- https://access.redhat.com/errata/RHSA-2018:3096
- https://github.com/torvalds/linux/commit/9de4ee40547fd315d4a0ed1dd15a2fa3559ad707
- https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html
- https://usn.ubuntu.com/3676-1/
- https://usn.ubuntu.com/3676-2/
- https://usn.ubuntu.com/3695-1/
- https://usn.ubuntu.com/3695-2/
- https://usn.ubuntu.com/3754-1/
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.6
HIGH7.5
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS 2.0MEDIUM 5.4
CVSS:2.0/AV:A/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
- http://tracker.ceph.com/issues/24836
- http://www.openwall.com/lists/oss-security/2020/11/17/3
- http://www.openwall.com/lists/oss-security/2020/11/17/4
- https://access.redhat.com/errata/RHSA-2018:2177
- https://access.redhat.com/errata/RHSA-2018:2179
- https://access.redhat.com/errata/RHSA-2018:2261
- https://access.redhat.com/errata/RHSA-2018:2274
- https://bugzilla.redhat.com/show_bug.cgi?id=1575866
- https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://www.debian.org/security/2018/dsa-4339
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
- http://tracker.ceph.com/issues/24836
- http://www.openwall.com/lists/oss-security/2020/11/17/3
- http://www.openwall.com/lists/oss-security/2020/11/17/4
- https://access.redhat.com/errata/RHSA-2018:2177
- https://access.redhat.com/errata/RHSA-2018:2179
- https://access.redhat.com/errata/RHSA-2018:2261
- https://access.redhat.com/errata/RHSA-2018:2274
- https://bugzilla.redhat.com/show_bug.cgi?id=1575866
- https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://www.debian.org/security/2018/dsa-4339
MEDIUM6.5
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS 2.0LOW 3.3
CVSS:2.0/AV:A/AC:L/Au:N/C:N/I:P/A:NCVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
- http://tracker.ceph.com/issues/24837
- https://access.redhat.com/errata/RHSA-2018:2177
- https://access.redhat.com/errata/RHSA-2018:2179
- https://access.redhat.com/errata/RHSA-2018:2261
- https://access.redhat.com/errata/RHSA-2018:2274
- https://bugzilla.redhat.com/show_bug.cgi?id=1576057
- https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://www.debian.org/security/2018/dsa-4339
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
- http://tracker.ceph.com/issues/24837
- https://access.redhat.com/errata/RHSA-2018:2177
- https://access.redhat.com/errata/RHSA-2018:2179
- https://access.redhat.com/errata/RHSA-2018:2261
- https://access.redhat.com/errata/RHSA-2018:2274
- https://bugzilla.redhat.com/show_bug.cgi?id=1576057
- https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://www.debian.org/security/2018/dsa-4339
MEDIUM6.1
An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.
CVSS 2.0LOW 3.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:PCVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4
- http://www.securityfocus.com/bid/105334
- https://access.redhat.com/errata/RHSA-2019:2029
- https://access.redhat.com/errata/RHSA-2019:2043
- https://access.redhat.com/errata/RHSA-2019:4154
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.6
- https://github.com/torvalds/linux/commit/8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4
- https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
- https://usn.ubuntu.com/3797-1/
- https://usn.ubuntu.com/3797-2/
- https://usn.ubuntu.com/3820-1/
- https://usn.ubuntu.com/3820-2/
- https://usn.ubuntu.com/3820-3/
- https://usn.ubuntu.com/3822-1/
- https://usn.ubuntu.com/3822-2/
- https://www.debian.org/security/2018/dsa-4308
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4
- http://www.securityfocus.com/bid/105334
- https://access.redhat.com/errata/RHSA-2019:2029
- https://access.redhat.com/errata/RHSA-2019:2043
- https://access.redhat.com/errata/RHSA-2019:4154
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.6
- https://github.com/torvalds/linux/commit/8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4
- https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
- https://usn.ubuntu.com/3797-1/
- https://usn.ubuntu.com/3797-2/
- https://usn.ubuntu.com/3820-1/
- https://usn.ubuntu.com/3820-2/
- https://usn.ubuntu.com/3820-3/
- https://usn.ubuntu.com/3822-1/
- https://usn.ubuntu.com/3822-2/
- https://www.debian.org/security/2018/dsa-4308
MEDIUM5.3
Salt improper handling of tmp files
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LReferences
- https://nvd.nist.gov/vuln/detail/CVE-2015-1838
- https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c
- https://bugzilla.redhat.com/show_bug.cgi?id=1212784
- https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-29.yaml
- https://github.com/saltstack/salt
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html