Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.853473
Category:SuSE Local Security Checks
Title:openSUSE: Security Advisory for the (openSUSE-SU-2020:1586-1)
Summary:The remote host is missing an update for the 'the'; package(s) announced via the openSUSE-SU-2020:1586-1 advisory.
Description:Summary:
The remote host is missing an update for the 'the'
package(s) announced via the openSUSE-SU-2020:1586-1 advisory.

Vulnerability Insight:
The openSUSE Leap 15.2 kernel was updated to receive various security and
bugfixes.

The following security bugs were fixed:

- CVE-2020-0404: In uvc_scan_chain_forward of uvc_driver.c, there is a
possible linked list corruption due to an unusual root cause. This could
lead to local escalation of privilege in the kernel with no additional
execution privileges needed. User interaction is not needed for
exploitation (bnc#1176423).

- CVE-2020-0427: In create_pinctrl of core.c, there is a possible out of
bounds read due to a use after free. This could lead to local
information disclosure with no additional execution privileges needed.
User interaction is not needed for exploitation (bnc#1176725).

- CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of
bounds write due to a missing bounds check. This could lead to local
escalation of privilege with no additional execution privileges needed.
User interaction is not needed for exploitation (bnc#1176722).

- CVE-2020-0432: In skb_to_mamac of networking.c, there is a possible out
of bounds write due to an integer overflow. This could lead to local
escalation of privilege with no additional execution privileges needed.
User interaction is not needed for exploitation (bnc#1176721).

- CVE-2020-14385: Fixed a boundary test in xfs_attr_shortform_verify which
could lead to crashes (bsc#1176137).

- CVE-2020-14390: When changing screen size, an out-of-bounds memory write
can occur leading to memory corruption or a denial of service. Due to
the nature of the flaw, privilege escalation cannot be fully ruled out
(bnc#1176235).

- CVE-2020-2521: Fixed a getxattr kernel panic and memory overflow in
NFS4(bsc#1176381).

- CVE-2020-25284: Require global CAP_SYS_ADMIN for mapping and unmapping
rbd devices (bsc#1176543).

- CVE-2020-26088: A missing CAP_NET_RAW check in NFC socket creation in
net/nfc/rawsock.c could be used by local attackers to create raw
sockets, bypassing security mechanisms, aka CID-26896f01467a
(bnc#1176990).

The following non-security bugs were fixed:

- ALSA: asihpi: fix iounmap in error handler (git-fixes).

- ALSA: ca0106: fix error code handling (git-fixes).

- ALSA: firewire-digi00x: exclude Avid Adrenaline from detection
(git-fixes).

- ALSA, firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).

- ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).

- ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
(git-fixes).

- ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A
PRO (git-fixes).
...

Description truncated. Please see the references for more information.

Affected Software/OS:
'the' package(s) on openSUSE Leap 15.2.

Solution:
Please install the updated package(s).

CVSS Score:
7.2

CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2020-0404
https://source.android.com/security/bulletin/2020-09-01
SuSE Security Announcement: openSUSE-SU-2020:1586 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html
SuSE Security Announcement: openSUSE-SU-2020:1655 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html
Common Vulnerability Exposure (CVE) ID: CVE-2020-0427
https://source.android.com/security/bulletin/pixel/2020-09-01
Common Vulnerability Exposure (CVE) ID: CVE-2020-0431
Common Vulnerability Exposure (CVE) ID: CVE-2020-0432
Common Vulnerability Exposure (CVE) ID: CVE-2020-2521
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.