LOW1.9
Уязвимость операционной системы Linux, позволяющая злоумышленнику получить доступ к конфиденциальной информации из памяти ядра
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
ALT-PU-2014-1383-1Обновление пакета kernel-image-el-def в ветке c7
Серьёзность:
Закрытые проблемы (71)
LOW1.9
Уязвимость операционной системы Linux, позволяющая злоумышленнику получить доступ к конфиденциальной информации из стековой памяти ядра
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
LOW1.9
Уязвимость операционной системы Linux, позволяющая злоумышленнику получить доступ к конфиденциальной информации из стековой памяти ядра
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
LOW1.9
Уязвимость операционной системы Linux, позволяющая злоумышленнику получить доступ к конфиденциальной информации из стековой памяти ядра
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
LOW1.9
Уязвимость операционной системы Linux, позволяющая злоумышленнику получить доступ к конфиденциальной информации из стековой памяти ядра
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
LOW3.2
Уязвимость операционной системы Linux, позволяющая злоумышленнику осуществить доступ к защищаемой информации или вызвать отказ в обслуживании
CVSS 2.0НИЗКАЯ 3.2
CVSS:2.0/AV:A/AC:H/Au:N/C:P/I:N/A:PСсылки
MEDIUM4.7
Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать локальный отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
LOW3.3
Уязвимость операционной системы Linux, приводящая к раскрытию информации
CVSS 2.0НИЗКАЯ 3.3
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:P/A:NСсылки
MEDIUM4.7
Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
MEDIUM6.0
Уязвимость операционной системы Linux, позволяющая злоумышленнику получить доступ к конфиденциальной информации из памяти ядра
CVSS 2.0СРЕДНЯЯ 6.0
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:PСсылки
MEDIUM5.8
Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 5.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:NСсылки
MEDIUM5.7
Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 5.7
CVSS:2.0/AV:A/AC:M/Au:N/C:N/I:N/A:CСсылки
HIGH7.2
Уязвимости операционной системы Debian GNU/Linux, позволяющие локальному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCRITICAL10.0
Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CСсылки
- CVE-2012-2372
- CVE-2013-2929
- CVE-2013-4299
- CVE-2013-4579
- CVE-2013-6382
- CVE-2013-7339
- CVE-2014-0055
- CVE-2014-0077
- CVE-2014-0101
- CVE-2014-0131
- CVE-2014-0155
- CVE-2014-1444
- CVE-2014-1445
- CVE-2014-1446
- CVE-2014-1874
- CVE-2014-2309
- CVE-2014-2523
- CVE-2014-2678
- CVE-2014-2851
- CVE-2014-3122
- CVE-2014-3144
- CVE-2014-3145
- CVE-2014-3917
- CVE-2014-4652
- CVE-2014-4653
- CVE-2014-4654
- CVE-2014-4655
- CVE-2014-4656
- CVE-2014-4699
CRITICAL10.0
Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CСсылки
- CVE-2012-2372
- CVE-2013-2929
- CVE-2013-4299
- CVE-2013-4579
- CVE-2013-6382
- CVE-2013-7339
- CVE-2014-0055
- CVE-2014-0077
- CVE-2014-0101
- CVE-2014-0131
- CVE-2014-0155
- CVE-2014-1444
- CVE-2014-1445
- CVE-2014-1446
- CVE-2014-1874
- CVE-2014-2309
- CVE-2014-2523
- CVE-2014-2678
- CVE-2014-2851
- CVE-2014-3122
- CVE-2014-3144
- CVE-2014-3145
- CVE-2014-3917
- CVE-2014-4652
- CVE-2014-4653
- CVE-2014-4654
- CVE-2014-4655
- CVE-2014-4656
- CVE-2014-4699
CRITICAL10.0
Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CСсылки
- CVE-2012-2372
- CVE-2013-2929
- CVE-2013-4299
- CVE-2013-4579
- CVE-2013-6382
- CVE-2013-7339
- CVE-2014-0055
- CVE-2014-0077
- CVE-2014-0101
- CVE-2014-0131
- CVE-2014-0155
- CVE-2014-1444
- CVE-2014-1445
- CVE-2014-1446
- CVE-2014-1874
- CVE-2014-2309
- CVE-2014-2523
- CVE-2014-2678
- CVE-2014-2851
- CVE-2014-3122
- CVE-2014-3144
- CVE-2014-3145
- CVE-2014-3917
- CVE-2014-4652
- CVE-2014-4653
- CVE-2014-4654
- CVE-2014-4655
- CVE-2014-4656
- CVE-2014-4699
CRITICAL10.0
Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CСсылки
- CVE-2012-2372
- CVE-2013-2929
- CVE-2013-4299
- CVE-2013-4579
- CVE-2013-6382
- CVE-2013-7339
- CVE-2014-0055
- CVE-2014-0077
- CVE-2014-0101
- CVE-2014-0131
- CVE-2014-0155
- CVE-2014-1444
- CVE-2014-1445
- CVE-2014-1446
- CVE-2014-1874
- CVE-2014-2309
- CVE-2014-2523
- CVE-2014-2678
- CVE-2014-2851
- CVE-2014-3122
- CVE-2014-3144
- CVE-2014-3145
- CVE-2014-3917
- CVE-2014-4652
- CVE-2014-4653
- CVE-2014-4654
- CVE-2014-4655
- CVE-2014-4656
- CVE-2014-4699
HIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.8
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.2
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CHIGH7.2
Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CLOW1.9
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1f86840f897717f86d523a13e99a447e6a5d2fa5
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7b789836f434c87168eab067cfbed1ec4783dffd
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f778a636713a435d3a922c60b1622a91136560c1
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1792-1
- http://www.ubuntu.com/usn/USN-1798-1
- https://github.com/torvalds/linux/commit/1f86840f897717f86d523a13e99a447e6a5d2fa5
- https://github.com/torvalds/linux/commit/7b789836f434c87168eab067cfbed1ec4783dffd
- https://github.com/torvalds/linux/commit/f778a636713a435d3a922c60b1622a91136560c1
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1f86840f897717f86d523a13e99a447e6a5d2fa5
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7b789836f434c87168eab067cfbed1ec4783dffd
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f778a636713a435d3a922c60b1622a91136560c1
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1792-1
- http://www.ubuntu.com/usn/USN-1798-1
- https://github.com/torvalds/linux/commit/1f86840f897717f86d523a13e99a447e6a5d2fa5
- https://github.com/torvalds/linux/commit/7b789836f434c87168eab067cfbed1ec4783dffd
- https://github.com/torvalds/linux/commit/f778a636713a435d3a922c60b1622a91136560c1
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
LOW1.9
The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3592aaeb80290bda0f2cf0b5456c97bfc638b192
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://github.com/torvalds/linux/commit/3592aaeb80290bda0f2cf0b5456c97bfc638b192
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3592aaeb80290bda0f2cf0b5456c97bfc638b192
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://github.com/torvalds/linux/commit/3592aaeb80290bda0f2cf0b5456c97bfc638b192
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
LOW1.9
The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9344a972961d1a6d2c04d9008b13617bcb6ec2ef
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9ad2de43f1aee7e7274a4e0d41465489299e344b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://github.com/torvalds/linux/commit/9344a972961d1a6d2c04d9008b13617bcb6ec2ef
- https://github.com/torvalds/linux/commit/9ad2de43f1aee7e7274a4e0d41465489299e344b
- https://github.com/torvalds/linux/commit/f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9344a972961d1a6d2c04d9008b13617bcb6ec2ef
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9ad2de43f1aee7e7274a4e0d41465489299e344b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://github.com/torvalds/linux/commit/9344a972961d1a6d2c04d9008b13617bcb6ec2ef
- https://github.com/torvalds/linux/commit/9ad2de43f1aee7e7274a4e0d41465489299e344b
- https://github.com/torvalds/linux/commit/f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
LOW1.9
The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e862f1a9b7df4e8196ebec45ac62295138aa3fc2
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://github.com/torvalds/linux/commit/3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a
- https://github.com/torvalds/linux/commit/e862f1a9b7df4e8196ebec45ac62295138aa3fc2
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e862f1a9b7df4e8196ebec45ac62295138aa3fc2
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://github.com/torvalds/linux/commit/3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a
- https://github.com/torvalds/linux/commit/e862f1a9b7df4e8196ebec45ac62295138aa3fc2
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
LOW1.9
The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a117dacde0288f3ec60b6e5bcedae8fa37ee0dfc
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- https://github.com/torvalds/linux/commit/a117dacde0288f3ec60b6e5bcedae8fa37ee0dfc
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a117dacde0288f3ec60b6e5bcedae8fa37ee0dfc
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- https://github.com/torvalds/linux/commit/a117dacde0288f3ec60b6e5bcedae8fa37ee0dfc
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2
MEDIUM6.2
The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d2b4d11d69a92574a55bfd985cfb0ca77aebdc
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.9
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/02/13/10
- http://www.ubuntu.com/usn/USN-1795-1
- http://www.ubuntu.com/usn/USN-1796-1
- http://www.ubuntu.com/usn/USN-1797-1
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://bugzilla.redhat.com/show_bug.cgi?id=906309
- https://github.com/torvalds/linux/commit/13d2b4d11d69a92574a55bfd985cfb0ca77aebdc
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d2b4d11d69a92574a55bfd985cfb0ca77aebdc
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.9
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/02/13/10
- http://www.ubuntu.com/usn/USN-1795-1
- http://www.ubuntu.com/usn/USN-1796-1
- http://www.ubuntu.com/usn/USN-1797-1
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://bugzilla.redhat.com/show_bug.cgi?id=906309
- https://github.com/torvalds/linux/commit/13d2b4d11d69a92574a55bfd985cfb0ca77aebdc
MEDIUM6.2
The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c903f0456bc69176912dee6dd25c6a66ee1aed00
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6
- http://www.openwall.com/lists/oss-security/2013/02/07/12
- https://bugzilla.redhat.com/show_bug.cgi?id=908693
- https://github.com/torvalds/linux/commit/c903f0456bc69176912dee6dd25c6a66ee1aed00
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c903f0456bc69176912dee6dd25c6a66ee1aed00
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6
- http://www.openwall.com/lists/oss-security/2013/02/07/12
- https://bugzilla.redhat.com/show_bug.cgi?id=908693
- https://github.com/torvalds/linux/commit/c903f0456bc69176912dee6dd25c6a66ee1aed00
LOW3.2
The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.
CVSS 2.0НИЗКАЯ 3.2
CVSS:2.0/AV:A/AC:H/Au:N/C:P/I:N/A:PСсылки
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://openwall.com/lists/oss-security/2012/12/05/4
- http://openwall.com/lists/oss-security/2013/01/16/7
- http://openwall.com/lists/oss-security/2013/01/21/11
- http://rhn.redhat.com/errata/RHSA-2013-1449.html
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.openwall.com/lists/oss-security/2013/02/22/6
- http://www.ubuntu.com/usn/USN-1976-1
- http://www.ubuntu.com/usn/USN-1977-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2020-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2023-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
- https://bugzilla.redhat.com/show_bug.cgi?id=914664
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://openwall.com/lists/oss-security/2012/12/05/4
- http://openwall.com/lists/oss-security/2013/01/16/7
- http://openwall.com/lists/oss-security/2013/01/21/11
- http://rhn.redhat.com/errata/RHSA-2013-1449.html
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.openwall.com/lists/oss-security/2013/02/22/6
- http://www.ubuntu.com/usn/USN-1976-1
- http://www.ubuntu.com/usn/USN-1977-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2020-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2023-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
- https://bugzilla.redhat.com/show_bug.cgi?id=914664
LOW1.9
The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0a9ab9bdb3e891762553f667066190c1d22ad62b
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6
- http://www.openwall.com/lists/oss-security/2013/02/23/3
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://bugzilla.redhat.com/show_bug.cgi?id=914298
- https://github.com/torvalds/linux/commit/0a9ab9bdb3e891762553f667066190c1d22ad62b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0a9ab9bdb3e891762553f667066190c1d22ad62b
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6
- http://www.openwall.com/lists/oss-security/2013/02/23/3
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- https://bugzilla.redhat.com/show_bug.cgi?id=914298
- https://github.com/torvalds/linux/commit/0a9ab9bdb3e891762553f667066190c1d22ad62b
MEDIUM6.9
Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.
CVSS 2.0СРЕДНЯЯ 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9899d11f654474d2d54ea52ceaa2a1f4db3abd68
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2013-0567.html
- http://rhn.redhat.com/errata/RHSA-2013-0661.html
- http://rhn.redhat.com/errata/RHSA-2013-0662.html
- http://rhn.redhat.com/errata/RHSA-2013-0695.html
- http://www.debian.org/security/2013/dsa-2632
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5
- http://www.openwall.com/lists/oss-security/2013/02/15/16
- http://www.ubuntu.com/usn/USN-1736-1
- http://www.ubuntu.com/usn/USN-1737-1
- http://www.ubuntu.com/usn/USN-1738-1
- http://www.ubuntu.com/usn/USN-1739-1
- http://www.ubuntu.com/usn/USN-1740-1
- http://www.ubuntu.com/usn/USN-1741-1
- http://www.ubuntu.com/usn/USN-1742-1
- http://www.ubuntu.com/usn/USN-1743-1
- http://www.ubuntu.com/usn/USN-1744-1
- http://www.ubuntu.com/usn/USN-1745-1
- https://bugzilla.redhat.com/show_bug.cgi?id=911937
- https://github.com/torvalds/linux/commit/9899d11f654474d2d54ea52ceaa2a1f4db3abd68
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9899d11f654474d2d54ea52ceaa2a1f4db3abd68
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2013-0567.html
- http://rhn.redhat.com/errata/RHSA-2013-0661.html
- http://rhn.redhat.com/errata/RHSA-2013-0662.html
- http://rhn.redhat.com/errata/RHSA-2013-0695.html
- http://www.debian.org/security/2013/dsa-2632
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5
- http://www.openwall.com/lists/oss-security/2013/02/15/16
- http://www.ubuntu.com/usn/USN-1736-1
- http://www.ubuntu.com/usn/USN-1737-1
- http://www.ubuntu.com/usn/USN-1738-1
- http://www.ubuntu.com/usn/USN-1739-1
- http://www.ubuntu.com/usn/USN-1740-1
- http://www.ubuntu.com/usn/USN-1741-1
- http://www.ubuntu.com/usn/USN-1742-1
- http://www.ubuntu.com/usn/USN-1743-1
- http://www.ubuntu.com/usn/USN-1744-1
- http://www.ubuntu.com/usn/USN-1745-1
- https://bugzilla.redhat.com/show_bug.cgi?id=911937
- https://github.com/torvalds/linux/commit/9899d11f654474d2d54ea52ceaa2a1f4db3abd68
HIGH7.2
Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition.
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CСсылки
- http://git.chromium.org/gitweb/?p=chromiumos/third_party/kernel.git%3Ba=commit%3Bh=c79efdf2b7f68f985922a8272d64269ecd490477
- http://googlechromereleases.blogspot.com/2013/03/stable-channel-update-for-chrome-os_15.html
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://openwall.com/lists/oss-security/2013/03/11/6
- http://openwall.com/lists/oss-security/2013/03/13/9
- http://openwall.com/lists/oss-security/2013/03/14/22
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1811-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- http://www.ubuntu.com/usn/USN-1814-1
- https://bugzilla.redhat.com/show_bug.cgi?id=920471
- https://code.google.com/p/chromium-os/issues/detail?id=39733
- https://gerrit.chromium.org/gerrit/45118
- https://lkml.org/lkml/2013/3/11/501
- http://git.chromium.org/gitweb/?p=chromiumos/third_party/kernel.git%3Ba=commit%3Bh=c79efdf2b7f68f985922a8272d64269ecd490477
- http://googlechromereleases.blogspot.com/2013/03/stable-channel-update-for-chrome-os_15.html
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://openwall.com/lists/oss-security/2013/03/11/6
- http://openwall.com/lists/oss-security/2013/03/13/9
- http://openwall.com/lists/oss-security/2013/03/14/22
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1811-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- http://www.ubuntu.com/usn/USN-1814-1
- https://bugzilla.redhat.com/show_bug.cgi?id=920471
- https://code.google.com/p/chromium-os/issues/detail?id=39733
- https://gerrit.chromium.org/gerrit/45118
- https://lkml.org/lkml/2013/3/11/501
MEDIUM6.2
Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5f00110f7273f9ff04ac69a5f85bb535a4fd0987
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0882.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.10
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/02/25/23
- http://www.ubuntu.com/usn/USN-1787-1
- http://www.ubuntu.com/usn/USN-1788-1
- http://www.ubuntu.com/usn/USN-1792-1
- http://www.ubuntu.com/usn/USN-1793-1
- http://www.ubuntu.com/usn/USN-1794-1
- http://www.ubuntu.com/usn/USN-1795-1
- http://www.ubuntu.com/usn/USN-1796-1
- http://www.ubuntu.com/usn/USN-1797-1
- http://www.ubuntu.com/usn/USN-1798-1
- https://bugzilla.redhat.com/show_bug.cgi?id=915592
- https://github.com/torvalds/linux/commit/5f00110f7273f9ff04ac69a5f85bb535a4fd0987
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5f00110f7273f9ff04ac69a5f85bb535a4fd0987
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0882.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.10
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/02/25/23
- http://www.ubuntu.com/usn/USN-1787-1
- http://www.ubuntu.com/usn/USN-1788-1
- http://www.ubuntu.com/usn/USN-1792-1
- http://www.ubuntu.com/usn/USN-1793-1
- http://www.ubuntu.com/usn/USN-1794-1
- http://www.ubuntu.com/usn/USN-1795-1
- http://www.ubuntu.com/usn/USN-1796-1
- http://www.ubuntu.com/usn/USN-1797-1
- http://www.ubuntu.com/usn/USN-1798-1
- https://bugzilla.redhat.com/show_bug.cgi?id=915592
- https://github.com/torvalds/linux/commit/5f00110f7273f9ff04ac69a5f85bb535a4fd0987
MEDIUM6.2
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.exploit-db.com/exploits/23248/
- http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.3.bz2
- http://www.openwall.com/lists/oss-security/2013/02/26/8
- http://www.osvdb.org/88310
- http://www.securityfocus.com/bid/58200
- https://bugzilla.redhat.com/show_bug.cgi?id=916115
- https://github.com/torvalds/linux/commit/0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.exploit-db.com/exploits/23248/
- http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.3.bz2
- http://www.openwall.com/lists/oss-security/2013/02/26/8
- http://www.osvdb.org/88310
- http://www.securityfocus.com/bid/58200
- https://bugzilla.redhat.com/show_bug.cgi?id=916115
- https://github.com/torvalds/linux/commit/0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd
MEDIUM4.0
The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.
CVSS 2.0СРЕДНЯЯ 4.0
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:N/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1ee0a224bc9aad1de496c795f96bc6ba2c394811
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.4
- http://www.openwall.com/lists/oss-security/2013/02/27/29
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- http://xorl.wordpress.com/2013/05/18/cve-2013-1774-linux-kernel-edgeport-usb-serial-converter-null-pointer-dereference/
- https://bugzilla.redhat.com/show_bug.cgi?id=916191
- https://github.com/torvalds/linux/commit/1ee0a224bc9aad1de496c795f96bc6ba2c394811
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1ee0a224bc9aad1de496c795f96bc6ba2c394811
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.4
- http://www.openwall.com/lists/oss-security/2013/02/27/29
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- http://xorl.wordpress.com/2013/05/18/cve-2013-1774-linux-kernel-edgeport-usb-serial-converter-null-pointer-dereference/
- https://bugzilla.redhat.com/show_bug.cgi?id=916191
- https://github.com/torvalds/linux/commit/1ee0a224bc9aad1de496c795f96bc6ba2c394811
MEDIUM4.7
Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0da9dfdd2cd9889201bc6f6f43580c99165cd087
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.3
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/07/1
- http://www.ubuntu.com/usn/USN-1787-1
- http://www.ubuntu.com/usn/USN-1788-1
- http://www.ubuntu.com/usn/USN-1792-1
- http://www.ubuntu.com/usn/USN-1793-1
- http://www.ubuntu.com/usn/USN-1794-1
- http://www.ubuntu.com/usn/USN-1795-1
- http://www.ubuntu.com/usn/USN-1796-1
- http://www.ubuntu.com/usn/USN-1797-1
- http://www.ubuntu.com/usn/USN-1798-1
- https://bugzilla.redhat.com/show_bug.cgi?id=916646
- https://github.com/torvalds/linux/commit/0da9dfdd2cd9889201bc6f6f43580c99165cd087
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0da9dfdd2cd9889201bc6f6f43580c99165cd087
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.3
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/07/1
- http://www.ubuntu.com/usn/USN-1787-1
- http://www.ubuntu.com/usn/USN-1788-1
- http://www.ubuntu.com/usn/USN-1792-1
- http://www.ubuntu.com/usn/USN-1793-1
- http://www.ubuntu.com/usn/USN-1794-1
- http://www.ubuntu.com/usn/USN-1795-1
- http://www.ubuntu.com/usn/USN-1796-1
- http://www.ubuntu.com/usn/USN-1797-1
- http://www.ubuntu.com/usn/USN-1798-1
- https://bugzilla.redhat.com/show_bug.cgi?id=916646
- https://github.com/torvalds/linux/commit/0da9dfdd2cd9889201bc6f6f43580c99165cd087
MEDIUM6.8
The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:A/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c300aa64ddf57d9c5d9c898a64b36877345dd4a9
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://rhn.redhat.com/errata/RHSA-2013-0727.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0746.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/20/9
- http://www.securityfocus.com/bid/58607
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- https://bugzilla.redhat.com/show_bug.cgi?id=917012
- https://github.com/torvalds/linux/commit/c300aa64ddf57d9c5d9c898a64b36877345dd4a9
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c300aa64ddf57d9c5d9c898a64b36877345dd4a9
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://rhn.redhat.com/errata/RHSA-2013-0727.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0746.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/20/9
- http://www.securityfocus.com/bid/58607
- http://www.ubuntu.com/usn/USN-1805-1
- http://www.ubuntu.com/usn/USN-1808-1
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- https://bugzilla.redhat.com/show_bug.cgi?id=917012
- https://github.com/torvalds/linux/commit/c300aa64ddf57d9c5d9c898a64b36877345dd4a9
MEDIUM6.8
Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:A/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0b79459b482e85cb7426aa7da683a9f2c97aeae1
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://rhn.redhat.com/errata/RHSA-2013-0727.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0746.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/20/9
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- https://bugzilla.redhat.com/show_bug.cgi?id=917013
- https://github.com/torvalds/linux/commit/0b79459b482e85cb7426aa7da683a9f2c97aeae1
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0b79459b482e85cb7426aa7da683a9f2c97aeae1
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://rhn.redhat.com/errata/RHSA-2013-0727.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0746.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/20/9
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- https://bugzilla.redhat.com/show_bug.cgi?id=917013
- https://github.com/torvalds/linux/commit/0b79459b482e85cb7426aa7da683a9f2c97aeae1
MEDIUM6.2
The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:A/AC:H/Au:N/C:C/I:N/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a2c118bfab8bc6b8bb213abfc35201e441693d55
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html
- http://rhn.redhat.com/errata/RHSA-2013-0727.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0746.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/20/9
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- https://bugzilla.redhat.com/show_bug.cgi?id=917017
- https://github.com/torvalds/linux/commit/a2c118bfab8bc6b8bb213abfc35201e441693d55
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a2c118bfab8bc6b8bb213abfc35201e441693d55
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html
- http://rhn.redhat.com/errata/RHSA-2013-0727.html
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://rhn.redhat.com/errata/RHSA-2013-0746.html
- http://rhn.redhat.com/errata/RHSA-2013-0928.html
- http://rhn.redhat.com/errata/RHSA-2013-1026.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/03/20/9
- http://www.ubuntu.com/usn/USN-1809-1
- http://www.ubuntu.com/usn/USN-1812-1
- http://www.ubuntu.com/usn/USN-1813-1
- https://bugzilla.redhat.com/show_bug.cgi?id=917017
- https://github.com/torvalds/linux/commit/a2c118bfab8bc6b8bb213abfc35201e441693d55
MEDIUM6.2
The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=864745d291b5ba80ea0bd0edcbe67273de368836
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.7
- http://www.openwall.com/lists/oss-security/2013/03/07/2
- http://www.ubuntu.com/usn/USN-1829-1
- https://bugzilla.redhat.com/show_bug.cgi?id=919384
- https://github.com/torvalds/linux/commit/864745d291b5ba80ea0bd0edcbe67273de368836
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=864745d291b5ba80ea0bd0edcbe67273de368836
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.7
- http://www.openwall.com/lists/oss-security/2013/03/07/2
- http://www.ubuntu.com/usn/USN-1829-1
- https://bugzilla.redhat.com/show_bug.cgi?id=919384
- https://github.com/torvalds/linux/commit/864745d291b5ba80ea0bd0edcbe67273de368836
MEDIUM6.2
net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=276bdb82dedb290511467a5a4fdbe9f0b52dce6f
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4
- http://www.openwall.com/lists/oss-security/2013/03/07/2
- https://bugzilla.redhat.com/show_bug.cgi?id=919164
- https://github.com/torvalds/linux/commit/276bdb82dedb290511467a5a4fdbe9f0b52dce6f
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=276bdb82dedb290511467a5a4fdbe9f0b52dce6f
- http://rhn.redhat.com/errata/RHSA-2013-0744.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4
- http://www.openwall.com/lists/oss-security/2013/03/07/2
- https://bugzilla.redhat.com/show_bug.cgi?id=919164
- https://github.com/torvalds/linux/commit/276bdb82dedb290511467a5a4fdbe9f0b52dce6f
MEDIUM4.7
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=12176503366885edd542389eed3aaf94be163fdb
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.5
- http://www.openwall.com/lists/oss-security/2013/04/06/2
- http://www.openwall.com/lists/oss-security/2013/04/09/6
- http://www.ubuntu.com/usn/USN-1829-1
- https://bugzilla.redhat.com/show_bug.cgi?id=949567
- https://github.com/torvalds/linux/commit/12176503366885edd542389eed3aaf94be163fdb
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=12176503366885edd542389eed3aaf94be163fdb
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.5
- http://www.openwall.com/lists/oss-security/2013/04/06/2
- http://www.openwall.com/lists/oss-security/2013/04/09/6
- http://www.ubuntu.com/usn/USN-1829-1
- https://bugzilla.redhat.com/show_bug.cgi?id=949567
- https://github.com/torvalds/linux/commit/12176503366885edd542389eed3aaf94be163fdb
LOW2.1
The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://secunia.com/advisories/55055
- http://www.debian.org/security/2013/dsa-2766
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/06/04/10
- http://www.ubuntu.com/usn/USN-1899-1
- http://www.ubuntu.com/usn/USN-1900-1
- https://bugzilla.redhat.com/show_bug.cgi?id=970873
- https://github.com/torvalds/linux/commit/b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://secunia.com/advisories/55055
- http://www.debian.org/security/2013/dsa-2766
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/06/04/10
- http://www.ubuntu.com/usn/USN-1899-1
- http://www.ubuntu.com/usn/USN-1900-1
- https://bugzilla.redhat.com/show_bug.cgi?id=970873
- https://github.com/torvalds/linux/commit/b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
LOW2.1
The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/drivers/cdrom/cdrom.c?id=050e4b8fb7cdd7096c987a9cd556029c622c7fe2
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1166.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.openwall.com/lists/oss-security/2013/06/10/9
- http://www.ubuntu.com/usn/USN-1912-1
- http://www.ubuntu.com/usn/USN-1913-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- https://bugzilla.redhat.com/show_bug.cgi?id=973100
- http://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/drivers/cdrom/cdrom.c?id=050e4b8fb7cdd7096c987a9cd556029c622c7fe2
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1166.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.openwall.com/lists/oss-security/2013/06/10/9
- http://www.ubuntu.com/usn/USN-1912-1
- http://www.ubuntu.com/usn/USN-1913-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- https://bugzilla.redhat.com/show_bug.cgi?id=973100
LOW2.1
The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1166.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.openwall.com/lists/oss-security/2013/07/02/7
- http://www.ubuntu.com/usn/USN-1912-1
- http://www.ubuntu.com/usn/USN-1913-1
- http://www.ubuntu.com/usn/USN-1938-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- http://www.ubuntu.com/usn/USN-1943-1
- http://www.ubuntu.com/usn/USN-1944-1
- http://www.ubuntu.com/usn/USN-1945-1
- http://www.ubuntu.com/usn/USN-1946-1
- http://www.ubuntu.com/usn/USN-1947-1
- https://bugzilla.redhat.com/show_bug.cgi?id=980995
- https://github.com/torvalds/linux/commit/a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.10.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1166.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.openwall.com/lists/oss-security/2013/07/02/7
- http://www.ubuntu.com/usn/USN-1912-1
- http://www.ubuntu.com/usn/USN-1913-1
- http://www.ubuntu.com/usn/USN-1938-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- http://www.ubuntu.com/usn/USN-1943-1
- http://www.ubuntu.com/usn/USN-1944-1
- http://www.ubuntu.com/usn/USN-1945-1
- http://www.ubuntu.com/usn/USN-1946-1
- http://www.ubuntu.com/usn/USN-1947-1
- https://bugzilla.redhat.com/show_bug.cgi?id=980995
- https://github.com/torvalds/linux/commit/a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.10.bz2
MEDIUM6.0
Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.
CVSS 2.0СРЕДНЯЯ 6.0
CVSS:2.0/AV:L/AC:H/Au:S/C:C/I:C/A:CСсылки
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://marc.info/?l=linux-kernel&m=137055204522556&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://rhn.redhat.com/errata/RHSA-2013-1783.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.openwall.com/lists/oss-security/2013/06/06/13
- http://www.ubuntu.com/usn/USN-1912-1
- http://www.ubuntu.com/usn/USN-1913-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- https://bugzilla.redhat.com/show_bug.cgi?id=969515
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://marc.info/?l=linux-kernel&m=137055204522556&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://rhn.redhat.com/errata/RHSA-2013-1783.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.openwall.com/lists/oss-security/2013/06/06/13
- http://www.ubuntu.com/usn/USN-1912-1
- http://www.ubuntu.com/usn/USN-1913-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- https://bugzilla.redhat.com/show_bug.cgi?id=969515
MEDIUM6.2
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://marc.info/?l=linux-input&m=137772180514608&w=1
- http://openwall.com/lists/oss-security/2013/08/28/13
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.ubuntu.com/usn/USN-1976-1
- http://www.ubuntu.com/usn/USN-1977-1
- http://www.ubuntu.com/usn/USN-1995-1
- http://www.ubuntu.com/usn/USN-1998-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
- http://marc.info/?l=linux-input&m=137772180514608&w=1
- http://openwall.com/lists/oss-security/2013/08/28/13
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.ubuntu.com/usn/USN-1976-1
- http://www.ubuntu.com/usn/USN-1977-1
- http://www.ubuntu.com/usn/USN-1995-1
- http://www.ubuntu.com/usn/USN-1998-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
MEDIUM4.7
drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://marc.info/?l=linux-input&m=137772182014614&w=1
- http://openwall.com/lists/oss-security/2013/08/28/13
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.securityfocus.com/bid/62042
- http://www.ubuntu.com/usn/USN-2015-1
- http://www.ubuntu.com/usn/USN-2016-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2020-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2023-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
- http://marc.info/?l=linux-input&m=137772182014614&w=1
- http://openwall.com/lists/oss-security/2013/08/28/13
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.securityfocus.com/bid/62042
- http://www.ubuntu.com/usn/USN-2015-1
- http://www.ubuntu.com/usn/USN-2016-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2020-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2023-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
MEDIUM4.7
drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://marc.info/?l=linux-input&m=137772185414625&w=1
- http://openwall.com/lists/oss-security/2013/08/28/13
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.securityfocus.com/bid/62049
- http://www.ubuntu.com/usn/USN-1976-1
- http://www.ubuntu.com/usn/USN-1977-1
- http://www.ubuntu.com/usn/USN-1995-1
- http://www.ubuntu.com/usn/USN-1998-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
- http://marc.info/?l=linux-input&m=137772185414625&w=1
- http://openwall.com/lists/oss-security/2013/08/28/13
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.securityfocus.com/bid/62049
- http://www.ubuntu.com/usn/USN-1976-1
- http://www.ubuntu.com/usn/USN-1977-1
- http://www.ubuntu.com/usn/USN-1995-1
- http://www.ubuntu.com/usn/USN-1998-1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2050-1
LOW3.3
The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h.
CVSS 2.0НИЗКАЯ 3.3
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:P/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d049f74f2dbe71354d43d393ac3a188947811348
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
- http://rhn.redhat.com/errata/RHSA-2014-0100.html
- http://rhn.redhat.com/errata/RHSA-2014-0159.html
- http://rhn.redhat.com/errata/RHSA-2014-0285.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.2
- http://www.securityfocus.com/bid/64111
- http://www.ubuntu.com/usn/USN-2070-1
- http://www.ubuntu.com/usn/USN-2075-1
- http://www.ubuntu.com/usn/USN-2109-1
- http://www.ubuntu.com/usn/USN-2110-1
- http://www.ubuntu.com/usn/USN-2111-1
- http://www.ubuntu.com/usn/USN-2112-1
- http://www.ubuntu.com/usn/USN-2114-1
- http://www.ubuntu.com/usn/USN-2115-1
- http://www.ubuntu.com/usn/USN-2116-1
- http://www.ubuntu.com/usn/USN-2128-1
- http://www.ubuntu.com/usn/USN-2129-1
- https://access.redhat.com/errata/RHSA-2018:1252
- https://bugzilla.redhat.com/show_bug.cgi?id=1028148
- https://github.com/torvalds/linux/commit/d049f74f2dbe71354d43d393ac3a188947811348
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.54
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d049f74f2dbe71354d43d393ac3a188947811348
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
- http://rhn.redhat.com/errata/RHSA-2014-0100.html
- http://rhn.redhat.com/errata/RHSA-2014-0159.html
- http://rhn.redhat.com/errata/RHSA-2014-0285.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.2
- http://www.securityfocus.com/bid/64111
- http://www.ubuntu.com/usn/USN-2070-1
- http://www.ubuntu.com/usn/USN-2075-1
- http://www.ubuntu.com/usn/USN-2109-1
- http://www.ubuntu.com/usn/USN-2110-1
- http://www.ubuntu.com/usn/USN-2111-1
- http://www.ubuntu.com/usn/USN-2112-1
- http://www.ubuntu.com/usn/USN-2114-1
- http://www.ubuntu.com/usn/USN-2115-1
- http://www.ubuntu.com/usn/USN-2116-1
- http://www.ubuntu.com/usn/USN-2128-1
- http://www.ubuntu.com/usn/USN-2129-1
- https://access.redhat.com/errata/RHSA-2018:1252
- https://bugzilla.redhat.com/show_bug.cgi?id=1028148
- https://github.com/torvalds/linux/commit/d049f74f2dbe71354d43d393ac3a188947811348
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.54
MEDIUM4.7
The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:N/A:NСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c77a4b9cffb6215a15196ec499490d116dfad181
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103750.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104480.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/04/14/3
- http://www.ubuntu.com/usn/USN-1837-1
- https://github.com/torvalds/linux/commit/c77a4b9cffb6215a15196ec499490d116dfad181
- https://lkml.org/lkml/2013/4/14/107
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c77a4b9cffb6215a15196ec499490d116dfad181
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103750.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104480.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.openwall.com/lists/oss-security/2013/04/14/3
- http://www.ubuntu.com/usn/USN-1837-1
- https://github.com/torvalds/linux/commit/c77a4b9cffb6215a15196ec499490d116dfad181
- https://lkml.org/lkml/2013/4/14/107
MEDIUM4.7
The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1436.html
- http://rhn.redhat.com/errata/RHSA-2013-1460.html
- http://rhn.redhat.com/errata/RHSA-2013-1520.html
- http://secunia.com/advisories/54148
- http://secunia.com/advisories/55055
- http://www.openwall.com/lists/oss-security/2013/07/23/9
- http://www.securityfocus.com/bid/61411
- http://www.ubuntu.com/usn/USN-1938-1
- http://www.ubuntu.com/usn/USN-1939-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- http://www.ubuntu.com/usn/USN-1943-1
- http://www.ubuntu.com/usn/USN-1944-1
- http://www.ubuntu.com/usn/USN-1945-1
- http://www.ubuntu.com/usn/USN-1946-1
- http://www.ubuntu.com/usn/USN-1947-1
- https://bugzilla.redhat.com/show_bug.cgi?id=987627
- https://github.com/torvalds/linux/commit/8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1436.html
- http://rhn.redhat.com/errata/RHSA-2013-1460.html
- http://rhn.redhat.com/errata/RHSA-2013-1520.html
- http://secunia.com/advisories/54148
- http://secunia.com/advisories/55055
- http://www.openwall.com/lists/oss-security/2013/07/23/9
- http://www.securityfocus.com/bid/61411
- http://www.ubuntu.com/usn/USN-1938-1
- http://www.ubuntu.com/usn/USN-1939-1
- http://www.ubuntu.com/usn/USN-1941-1
- http://www.ubuntu.com/usn/USN-1942-1
- http://www.ubuntu.com/usn/USN-1943-1
- http://www.ubuntu.com/usn/USN-1944-1
- http://www.ubuntu.com/usn/USN-1945-1
- http://www.ubuntu.com/usn/USN-1946-1
- http://www.ubuntu.com/usn/USN-1947-1
- https://bugzilla.redhat.com/show_bug.cgi?id=987627
- https://github.com/torvalds/linux/commit/8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1
MEDIUM6.0
Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.
CVSS 2.0СРЕДНЯЯ 6.0
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:PСсылки
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9c6a182649f4259db704ae15a91ac820e63b0ca
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
- http://rhn.redhat.com/errata/RHSA-2013-1436.html
- http://rhn.redhat.com/errata/RHSA-2013-1449.html
- http://rhn.redhat.com/errata/RHSA-2013-1450.html
- http://rhn.redhat.com/errata/RHSA-2013-1460.html
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1519.html
- http://rhn.redhat.com/errata/RHSA-2013-1520.html
- http://rhn.redhat.com/errata/RHSA-2013-1783.html
- http://rhn.redhat.com/errata/RHSA-2013-1860.html
- http://www.ubuntu.com/usn/USN-2015-1
- http://www.ubuntu.com/usn/USN-2016-1
- http://www.ubuntu.com/usn/USN-2040-1
- http://www.ubuntu.com/usn/USN-2041-1
- http://www.ubuntu.com/usn/USN-2042-1
- http://www.ubuntu.com/usn/USN-2043-1
- http://www.ubuntu.com/usn/USN-2044-1
- http://www.ubuntu.com/usn/USN-2045-1
- http://www.ubuntu.com/usn/USN-2046-1
- http://www.ubuntu.com/usn/USN-2049-1
- http://www.ubuntu.com/usn/USN-2050-1
- http://www.ubuntu.com/usn/USN-2066-1
- http://www.ubuntu.com/usn/USN-2067-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1004233
- https://github.com/torvalds/linux/commit/e9c6a182649f4259db704ae15a91ac820e63b0ca
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9c6a182649f4259db704ae15a91ac820e63b0ca
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
- http://rhn.redhat.com/errata/RHSA-2013-1436.html
- http://rhn.redhat.com/errata/RHSA-2013-1449.html
- http://rhn.redhat.com/errata/RHSA-2013-1450.html
- http://rhn.redhat.com/errata/RHSA-2013-1460.html
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1519.html
- http://rhn.redhat.com/errata/RHSA-2013-1520.html
- http://rhn.redhat.com/errata/RHSA-2013-1783.html
- http://rhn.redhat.com/errata/RHSA-2013-1860.html
- http://www.ubuntu.com/usn/USN-2015-1
- http://www.ubuntu.com/usn/USN-2016-1
- http://www.ubuntu.com/usn/USN-2040-1
- http://www.ubuntu.com/usn/USN-2041-1
- http://www.ubuntu.com/usn/USN-2042-1
- http://www.ubuntu.com/usn/USN-2043-1
- http://www.ubuntu.com/usn/USN-2044-1
- http://www.ubuntu.com/usn/USN-2045-1
- http://www.ubuntu.com/usn/USN-2046-1
- http://www.ubuntu.com/usn/USN-2049-1
- http://www.ubuntu.com/usn/USN-2050-1
- http://www.ubuntu.com/usn/USN-2066-1
- http://www.ubuntu.com/usn/USN-2067-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1004233
- https://github.com/torvalds/linux/commit/e9c6a182649f4259db704ae15a91ac820e63b0ca
MEDIUM5.8
Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple requests for small amounts of data, leading to improper management of the state of the consumed data.
CVSS 2.0СРЕДНЯЯ 5.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:NСсылки
- http://marc.info/?l=linux-crypto-vger&m=137942122902845&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1449.html
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.securityfocus.com/bid/62740
- http://www.ubuntu.com/usn/USN-2064-1
- http://www.ubuntu.com/usn/USN-2065-1
- http://www.ubuntu.com/usn/USN-2068-1
- http://www.ubuntu.com/usn/USN-2070-1
- http://www.ubuntu.com/usn/USN-2071-1
- http://www.ubuntu.com/usn/USN-2072-1
- http://www.ubuntu.com/usn/USN-2074-1
- http://www.ubuntu.com/usn/USN-2075-1
- http://www.ubuntu.com/usn/USN-2076-1
- http://www.ubuntu.com/usn/USN-2109-1
- http://www.ubuntu.com/usn/USN-2110-1
- http://www.ubuntu.com/usn/USN-2158-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1007690
- http://marc.info/?l=linux-crypto-vger&m=137942122902845&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1449.html
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://www.securityfocus.com/bid/62740
- http://www.ubuntu.com/usn/USN-2064-1
- http://www.ubuntu.com/usn/USN-2065-1
- http://www.ubuntu.com/usn/USN-2068-1
- http://www.ubuntu.com/usn/USN-2070-1
- http://www.ubuntu.com/usn/USN-2071-1
- http://www.ubuntu.com/usn/USN-2072-1
- http://www.ubuntu.com/usn/USN-2074-1
- http://www.ubuntu.com/usn/USN-2075-1
- http://www.ubuntu.com/usn/USN-2076-1
- http://www.ubuntu.com/usn/USN-2109-1
- http://www.ubuntu.com/usn/USN-2110-1
- http://www.ubuntu.com/usn/USN-2158-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1007690
MEDIUM6.1
net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.
CVSS 2.0СРЕДНЯЯ 6.1
CVSS:2.0/AV:A/AC:L/Au:N/C:N/I:N/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2811ebac2521ceac84f2bdae402455baa6a7fb47
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/09/29/1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2041-1
- http://www.ubuntu.com/usn/USN-2045-1
- http://www.ubuntu.com/usn/USN-2049-1
- http://www.ubuntu.com/usn/USN-2050-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1011927
- https://github.com/torvalds/linux/commit/2811ebac2521ceac84f2bdae402455baa6a7fb47
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2811ebac2521ceac84f2bdae402455baa6a7fb47
- http://rhn.redhat.com/errata/RHSA-2013-1490.html
- http://rhn.redhat.com/errata/RHSA-2013-1645.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/09/29/1
- http://www.ubuntu.com/usn/USN-2019-1
- http://www.ubuntu.com/usn/USN-2021-1
- http://www.ubuntu.com/usn/USN-2022-1
- http://www.ubuntu.com/usn/USN-2024-1
- http://www.ubuntu.com/usn/USN-2038-1
- http://www.ubuntu.com/usn/USN-2039-1
- http://www.ubuntu.com/usn/USN-2041-1
- http://www.ubuntu.com/usn/USN-2045-1
- http://www.ubuntu.com/usn/USN-2049-1
- http://www.ubuntu.com/usn/USN-2050-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1011927
- https://github.com/torvalds/linux/commit/2811ebac2521ceac84f2bdae402455baa6a7fb47
MEDIUM6.9
The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.
CVSS 2.0СРЕДНЯЯ 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e93b7d748be887cd7639b113ba7d7ef792a7efb9
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://rhn.redhat.com/errata/RHSA-2014-0100.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/10/25/5
- http://www.securityfocus.com/bid/63359
- http://www.ubuntu.com/usn/USN-2040-1
- http://www.ubuntu.com/usn/USN-2042-1
- http://www.ubuntu.com/usn/USN-2043-1
- http://www.ubuntu.com/usn/USN-2044-1
- http://www.ubuntu.com/usn/USN-2046-1
- http://www.ubuntu.com/usn/USN-2049-1
- http://www.ubuntu.com/usn/USN-2050-1
- http://www.ubuntu.com/usn/USN-2066-1
- http://www.ubuntu.com/usn/USN-2067-1
- http://www.ubuntu.com/usn/USN-2069-1
- http://www.ubuntu.com/usn/USN-2073-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1023477
- https://github.com/torvalds/linux/commit/c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- https://github.com/torvalds/linux/commit/e93b7d748be887cd7639b113ba7d7ef792a7efb9
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.12.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e93b7d748be887cd7639b113ba7d7ef792a7efb9
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://rhn.redhat.com/errata/RHSA-2014-0100.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/10/25/5
- http://www.securityfocus.com/bid/63359
- http://www.ubuntu.com/usn/USN-2040-1
- http://www.ubuntu.com/usn/USN-2042-1
- http://www.ubuntu.com/usn/USN-2043-1
- http://www.ubuntu.com/usn/USN-2044-1
- http://www.ubuntu.com/usn/USN-2046-1
- http://www.ubuntu.com/usn/USN-2049-1
- http://www.ubuntu.com/usn/USN-2050-1
- http://www.ubuntu.com/usn/USN-2066-1
- http://www.ubuntu.com/usn/USN-2067-1
- http://www.ubuntu.com/usn/USN-2069-1
- http://www.ubuntu.com/usn/USN-2073-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1023477
- https://github.com/torvalds/linux/commit/c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b
- https://github.com/torvalds/linux/commit/e93b7d748be887cd7639b113ba7d7ef792a7efb9
- https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.12.bz2
HIGH7.0
Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33, when CONFIG_IP_VS is used, allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call, related to the do_ip_vs_get_ctl function, or (2) a setsockopt system call, related to the do_ip_vs_set_ctl function.
CVSS 2.0СРЕДНЯЯ 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xВЫСОКАЯ 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HСсылки
- http://ftp.linux.org.uk/pub/linux/linux-2.6/ChangeLog-2.6.33
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=04bcef2a83f40c6db24222b27a52892cba39dffb
- http://www.openwall.com/lists/oss-security/2013/11/15/12
- http://www.securityfocus.com/bid/63744
- http://www.ubuntu.com/usn/USN-2064-1
- http://www.ubuntu.com/usn/USN-2065-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1030800
- https://github.com/torvalds/linux/commit/04bcef2a83f40c6db24222b27a52892cba39dffb
- http://ftp.linux.org.uk/pub/linux/linux-2.6/ChangeLog-2.6.33
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=04bcef2a83f40c6db24222b27a52892cba39dffb
- http://www.openwall.com/lists/oss-security/2013/11/15/12
- http://www.securityfocus.com/bid/63744
- http://www.ubuntu.com/usn/USN-2064-1
- http://www.ubuntu.com/usn/USN-2065-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1030800
- https://github.com/torvalds/linux/commit/04bcef2a83f40c6db24222b27a52892cba39dffb
MEDIUM5.7
The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.
CVSS 2.0СРЕДНЯЯ 5.7
CVSS:2.0/AV:A/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b963a22e6d1a266a67e9eecc88134713fd54775c
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://rhn.redhat.com/errata/RHSA-2014-0163.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/12/12/12
- http://www.securityfocus.com/bid/64270
- http://www.ubuntu.com/usn/USN-2109-1
- http://www.ubuntu.com/usn/USN-2110-1
- http://www.ubuntu.com/usn/USN-2113-1
- http://www.ubuntu.com/usn/USN-2117-1
- http://www.ubuntu.com/usn/USN-2128-1
- http://www.ubuntu.com/usn/USN-2129-1
- http://www.ubuntu.com/usn/USN-2135-1
- http://www.ubuntu.com/usn/USN-2136-1
- http://www.ubuntu.com/usn/USN-2138-1
- http://www.ubuntu.com/usn/USN-2139-1
- http://www.ubuntu.com/usn/USN-2141-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1032207
- https://github.com/torvalds/linux/commit/b963a22e6d1a266a67e9eecc88134713fd54775c
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.54
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b963a22e6d1a266a67e9eecc88134713fd54775c
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://rhn.redhat.com/errata/RHSA-2014-0163.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/12/12/12
- http://www.securityfocus.com/bid/64270
- http://www.ubuntu.com/usn/USN-2109-1
- http://www.ubuntu.com/usn/USN-2110-1
- http://www.ubuntu.com/usn/USN-2113-1
- http://www.ubuntu.com/usn/USN-2117-1
- http://www.ubuntu.com/usn/USN-2128-1
- http://www.ubuntu.com/usn/USN-2129-1
- http://www.ubuntu.com/usn/USN-2135-1
- http://www.ubuntu.com/usn/USN-2136-1
- http://www.ubuntu.com/usn/USN-2138-1
- http://www.ubuntu.com/usn/USN-2139-1
- http://www.ubuntu.com/usn/USN-2141-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1032207
- https://github.com/torvalds/linux/commit/b963a22e6d1a266a67e9eecc88134713fd54775c
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.54
MEDIUM6.2
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
CVSS 2.0СРЕДНЯЯ 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CСсылки
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fda4e2e85589191b123d31cdc21fd33ee70f50fd
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://rhn.redhat.com/errata/RHSA-2014-0163.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/12/12/12
- http://www.securityfocus.com/bid/64291
- http://www.ubuntu.com/usn/USN-2113-1
- http://www.ubuntu.com/usn/USN-2117-1
- http://www.ubuntu.com/usn/USN-2133-1
- http://www.ubuntu.com/usn/USN-2134-1
- http://www.ubuntu.com/usn/USN-2135-1
- http://www.ubuntu.com/usn/USN-2136-1
- http://www.ubuntu.com/usn/USN-2138-1
- http://www.ubuntu.com/usn/USN-2139-1
- http://www.ubuntu.com/usn/USN-2141-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1032210
- https://github.com/torvalds/linux/commit/fda4e2e85589191b123d31cdc21fd33ee70f50fd
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fda4e2e85589191b123d31cdc21fd33ee70f50fd
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html
- http://rhn.redhat.com/errata/RHSA-2013-1801.html
- http://rhn.redhat.com/errata/RHSA-2014-0163.html
- http://rhn.redhat.com/errata/RHSA-2014-0284.html
- http://www.openwall.com/lists/oss-security/2013/12/12/12
- http://www.securityfocus.com/bid/64291
- http://www.ubuntu.com/usn/USN-2113-1
- http://www.ubuntu.com/usn/USN-2117-1
- http://www.ubuntu.com/usn/USN-2133-1
- http://www.ubuntu.com/usn/USN-2134-1
- http://www.ubuntu.com/usn/USN-2135-1
- http://www.ubuntu.com/usn/USN-2136-1
- http://www.ubuntu.com/usn/USN-2138-1
- http://www.ubuntu.com/usn/USN-2139-1
- http://www.ubuntu.com/usn/USN-2141-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1032210
- https://github.com/torvalds/linux/commit/fda4e2e85589191b123d31cdc21fd33ee70f50fd
NONE