Test ID:	1.3.6.1.4.1.25623.1.0.843377
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3485-2)
Summary:	The remote host is missing an update for the 'linux-lts-xenial' package(s) announced via the USN-3485-2 advisory.
Description:	Summary: The remote host is missing an update for the 'linux-lts-xenial' package(s) announced via the USN-3485-2 advisory. Vulnerability Insight: USN-3485-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15265) Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15299) It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15649) Eric Biggers discovered a race condition in the key management subsystem of the Linux kernel around keys in a negative state. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15951) Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16525) Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for an error condition. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16526) Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16527) Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16529) Andrey Konovalov discovered that the USB unattached storage driver in the Linux kernel contained out-of-bounds error when handling alternative settings. A physically proximate attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16530) Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB interface association descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16531) Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'linux-lts-xenial' package(s) on Ubuntu 14.04. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-15265 BugTraq ID: 101288 http://www.securityfocus.com/bid/101288 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71105998845fb012937332fe2e806d443c09e026 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8 https://bugzilla.suse.com/show_bug.cgi?id=1062520 https://github.com/torvalds/linux/commit/71105998845fb012937332fe2e806d443c09e026 https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 https://source.android.com/security/bulletin/2018-02-01 https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html http://mailman.alsa-project.org/pipermail/alsa-devel/2017-October/126292.html https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html http://www.openwall.com/lists/oss-security/2017/10/11/3 RedHat Security Advisories: RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:0676 RedHat Security Advisories: RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2018:1062 RedHat Security Advisories: RHSA-2018:1130 https://access.redhat.com/errata/RHSA-2018:1130 RedHat Security Advisories: RHSA-2018:1170 https://access.redhat.com/errata/RHSA-2018:1170 RedHat Security Advisories: RHSA-2018:2390 https://access.redhat.com/errata/RHSA-2018:2390 RedHat Security Advisories: RHSA-2018:3822 https://access.redhat.com/errata/RHSA-2018:3822 RedHat Security Advisories: RHSA-2018:3823 https://access.redhat.com/errata/RHSA-2018:3823 http://www.securitytracker.com/id/1039561 https://usn.ubuntu.com/3698-1/ https://usn.ubuntu.com/3698-2/ Common Vulnerability Exposure (CVE) ID: CVE-2017-15299 https://bugzilla.redhat.com/show_bug.cgi?id=1498016 https://marc.info/?t=150654188100001&r=1&w=2 https://marc.info/?t=150783958600011&r=1&w=2 https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1499828.html RedHat Security Advisories: RHSA-2018:0654 https://access.redhat.com/errata/RHSA-2018:0654 https://usn.ubuntu.com/3798-1/ https://usn.ubuntu.com/3798-2/ Common Vulnerability Exposure (CVE) ID: CVE-2017-15649 BugTraq ID: 101573 http://www.securityfocus.com/bid/101573 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=008ba2a13f2d04c947adc536d19debb8fe66f110 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4971613c1639d8e5f102c4e797c3bf8f83a5a69e http://patchwork.ozlabs.org/patch/813945/ http://patchwork.ozlabs.org/patch/818726/ http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6 https://blogs.securiteam.com/index.php/archives/3484 https://github.com/torvalds/linux/commit/008ba2a13f2d04c947adc536d19debb8fe66f110 https://github.com/torvalds/linux/commit/4971613c1639d8e5f102c4e797c3bf8f83a5a69e RedHat Security Advisories: RHSA-2018:0151 https://access.redhat.com/errata/RHSA-2018:0151 RedHat Security Advisories: RHSA-2018:0152 https://access.redhat.com/errata/RHSA-2018:0152 RedHat Security Advisories: RHSA-2018:0181 https://access.redhat.com/errata/RHSA-2018:0181 https://usn.ubuntu.com/3754-1/ Common Vulnerability Exposure (CVE) ID: CVE-2017-15951 BugTraq ID: 101621 http://www.securityfocus.com/bid/101621 Common Vulnerability Exposure (CVE) ID: CVE-2017-16525 BugTraq ID: 102028 http://www.securityfocus.com/bid/102028 https://github.com/torvalds/linux/commit/299d7572e46f98534033a9e65973f13ad1ce9047 https://github.com/torvalds/linux/commit/bd998c2e0df0469707503023d50d46cf0b10c787 https://groups.google.com/d/msg/syzkaller/cMACrmo1x0k/4KhRoUgABAAJ https://usn.ubuntu.com/3583-1/ https://usn.ubuntu.com/3583-2/ Common Vulnerability Exposure (CVE) ID: CVE-2017-16526 Debian Security Information: DSA-4187 (Google Search) https://www.debian.org/security/2018/dsa-4187 https://github.com/torvalds/linux/commit/bbf26183b7a6236ba602f4d6a2f7cade35bba043 https://groups.google.com/d/msg/syzkaller/zROBxKXzHDk/5I6aZ3O2AgAJ https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html Common Vulnerability Exposure (CVE) ID: CVE-2017-16527 https://github.com/torvalds/linux/commit/124751d5e63c823092060074bd0abaae61aaa9c4 https://groups.google.com/d/msg/syzkaller/jf7GTr_g2CU/iVlLhMciCQAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16529 BugTraq ID: 103284 http://www.securityfocus.com/bid/103284 https://github.com/torvalds/linux/commit/bfc81a8bc18e3c4ba0cbaa7666ff76be2f998991 https://groups.google.com/d/msg/syzkaller/rDzv5RP_f2M/M5au06qmAwAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16530 https://github.com/torvalds/linux/commit/786de92b3cb26012d3d0f00ee37adf14527f35c4 https://groups.google.com/d/msg/syzkaller/pCswO77gRlM/VHuPOftgAwAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16531 BugTraq ID: 102025 http://www.securityfocus.com/bid/102025 https://github.com/torvalds/linux/commit/bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb https://groups.google.com/d/msg/syzkaller/hP6L-m59m_8/Co2ouWeFAwAJ https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Common Vulnerability Exposure (CVE) ID: CVE-2017-16533 BugTraq ID: 102026 http://www.securityfocus.com/bid/102026 https://github.com/torvalds/linux/commit/f043bfc98c193c284e2cd768fefabe18ac2fed9b https://groups.google.com/d/msg/syzkaller/CxkJ9QZgwlM/O3IOvAaGAwAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16534 https://github.com/torvalds/linux/commit/2e1c42391ff2556387b3cb6308b24f6f65619feb https://groups.google.com/d/msg/syzkaller/nXnjqI73uPo/6sUyq6kqAgAJ SuSE Security Announcement: SUSE-SU-2018:0011 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html Common Vulnerability Exposure (CVE) ID: CVE-2017-16535 BugTraq ID: 102022 http://www.securityfocus.com/bid/102022 https://github.com/torvalds/linux/commit/1c0edc3633b56000e18d82fc241e3995ca18a69e https://groups.google.com/d/msg/syzkaller/tzdz2fTB1K0/OvjIgLSTAgAJ
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.