Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.853490
Category:SuSE Local Security Checks
Title:openSUSE: Security Advisory for the (openSUSE-SU-2020:1655-1)
Summary:The remote host is missing an update for the 'the'; package(s) announced via the openSUSE-SU-2020:1655-1 advisory.
Description:Summary:
The remote host is missing an update for the 'the'
package(s) announced via the openSUSE-SU-2020:1655-1 advisory.

Vulnerability Insight:
The openSUSE Leap 15.1 kernel was updated to receive various security and
bugfixes.

The following security bugs were fixed:

- CVE-2020-25212: Fixed nfs getxattr kernel panic and memory overflow that
could lead to crashes or privilege escalations (bsc#1176381).

- CVE-2020-14381: Fixed inode life-time issue in futex handling
(bsc#1176011).

- CVE-2020-25643: Memory corruption and a read overflow is caused by
improper input validation in the ppp_cp_parse_cr function which can
cause the system to crash or cause a denial of service. The highest
threat from this vulnerability is to data confidentiality and integrity
as well as system availability (bnc#1177206).

- CVE-2020-25641: A zero-length biovec request issued by the block
subsystem could cause the kernel to enter an infinite loop, causing a
denial of service. This flaw allowed a local attacker with basic
privileges to issue requests to a block device, resulting in a denial of
service. The highest threat from this vulnerability is to system
availability (bnc#1177121).

- CVE-2020-26088: A missing CAP_NET_RAW check in NFC socket creation in
net/nfc/rawsock.c could be used by local attackers to create raw
sockets, bypassing security mechanisms, aka CID-26896f01467a
(bnc#1176990).

- CVE-2020-14390: When changing screen size, an out-of-bounds memory write
can occur leading to memory corruption or a denial of service. Due to
the nature of the flaw, privilege escalation cannot be fully ruled out
(bnc#1176235 bnc#1176278).

- CVE-2020-0432: In skb_to_mamac of networking.c, there is a possible out
of bounds write due to an integer overflow. This could lead to local
escalation of privilege with no additional execution privileges needed.
User interaction is not needed for exploitation (bnc#1176721).

- CVE-2020-0427: In create_pinctrl of core.c, there is a possible out of
bounds read due to a use after free. This could lead to local
information disclosure with no additional execution privileges needed.
User interaction is not needed for exploitation (bnc#1176725).

- CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of
bounds write due to a missing bounds check. This could lead to local
escalation of privilege with no additional execution privileges needed.
User interaction is not needed for exploitation (bnc#1176722).

- CVE-2020-0404: In uvc_scan_chain_forward of uvc_driver.c, there is a
possible linked list corruption due to an unusual root cause. This could
lead to local escalation of privilege in the kernel with no additional
execution privileges

Description truncated. Please see the references for more information.

Affected Software/OS:
'the' package(s) on openSUSE Leap 15.1.

Solution:
Please install the updated package(s).

CVSS Score:
7.2

CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2020-0404
https://source.android.com/security/bulletin/2020-09-01
SuSE Security Announcement: openSUSE-SU-2020:1586 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html
SuSE Security Announcement: openSUSE-SU-2020:1655 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html
Common Vulnerability Exposure (CVE) ID: CVE-2020-0427
https://source.android.com/security/bulletin/pixel/2020-09-01
Common Vulnerability Exposure (CVE) ID: CVE-2020-0431
Common Vulnerability Exposure (CVE) ID: CVE-2020-0432
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.