| Description: | Summary:
The remote host is missing an update for the 'Linux'
package(s) announced via the referenced advisory.
Vulnerability Insight:
The SUSE Linux Enterprise 11 Service Pack 1 LTSS kernel was updated to fix
security issues on kernels on the x86_64 architecture.
The following security bugs have been fixed:
* CVE-2013-4299: Interpretation conflict in
drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6
allowed remote authenticated users to obtain sensitive information
or modify data via a crafted mapping to a snapshot block device
(bnc#846404).
* CVE-2014-8160: SCTP firewalling failed until the SCTP module was
loaded (bnc#913059).
* CVE-2014-9584: The parse_rock_ridge_inode_internal function in
fs/isofs/rock.c in the Linux kernel before 3.18.2 did not validate a
length value in the Extensions Reference (ER) System Use Field,
which allowed local users to obtain sensitive information from
kernel memory via a crafted iso9660 image (bnc#912654).
* CVE-2014-9585: The vdso_addr function in arch/x86/vdso/vma.c in the
Linux kernel through 3.18.2 did not properly choose memory locations
for the vDSO area, which made it easier for local users to bypass
the ASLR protection mechanism by guessing a location at the end of a
PMD (bnc#912705).
* CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the
Linux kernel through 3.18.1 did not restrict the number of Rock
Ridge continuation entries, which allowed local users to cause a
denial of service (infinite loop, and system crash or hang) via a
crafted iso9660 image (bnc#911325).
* CVE-2014-0181: The Netlink implementation in the Linux kernel
through 3.14.1 did not provide a mechanism for authorizing socket
operations based on the opener of a socket, which allowed local
users to bypass intended access restrictions and modify network
configurations by using a Netlink socket for the (1) stdout or (2)
stderr of a setuid program (bnc#875051).
* CVE-2010-5313: Race condition in arch/x86/kvm/x86.c in the Linux
kernel before 2.6.38 allowed L2 guest OS users to cause a denial of
service (L1 guest OS crash) via a crafted instruction that triggers
an L2 emulation failure report, a similar issue to CVE-2014-7842
(bnc#907822).
* CVE-2014-7842: Race condition in arch/x86/kvm/x86.c in the Linux
kernel before 3.17.4 allowed guest OS users to cause a denial of
service (guest OS crash) via a crafted application that performs an
MMIO transaction or a PIO transaction to trigger a guest userspace
emulation error report, a similar issue to CVE-2010-5313
(bnc#905312).
* CVE-2014-3688: The SCTP implementation in the Linux kernel before
3.17.4 allowed remote attackers to caus ...
Description truncated, please see the referenced URL(s) for more information.
Affected Software/OS:
Linux on SUSE Linux Enterprise Server 11 SP1 LTSS
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
