Vulnerability   
Search   
    Search 187964 CVE descriptions
and 85075 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.892241
Category:Debian Local Security Checks
Title:Debian LTS: Security Advisory for linux (DLA-2241-1)
Summary:The remote host is missing an update for the 'linux'; package(s) announced via the DLA-2241-1 advisory.
Description:Summary:
The remote host is missing an update for the 'linux'
package(s) announced via the DLA-2241-1 advisory.

Vulnerability Insight:
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

CVE-2015-8839

A race condition was found in the ext4 filesystem implementation.
A local user could exploit this to cause a denial of service
(filesystem corruption).

CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613

Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes
could trigger a crash (Oops) and/or out-of-bounds memory access.
An attacker able to mount such a volume could use this to cause a
denial of service or possibly for privilege escalation.

CVE-2019-5108

Mitchell Frank of Cisco discovered that when the IEEE 802.11
(WiFi) stack was used in AP mode with roaming, it would trigger
roaming for a newly associated station before the station was
authenticated. An attacker within range of the AP could use this
to cause a denial of service, either by filling up a switching
table or by redirecting traffic away from other stations.

CVE-2019-19319

Jungyeon discovered that a crafted filesystem can cause the ext4
implementation to deallocate or reallocate journal blocks. A user
permitted to mount filesystems could use this to cause a denial of
service (crash), or possibly for privilege escalation.

CVE-2019-19447

It was discovered that the ext4 filesystem driver did not safely
handle unlinking of an inode that, due to filesystem corruption,
already has a link count of 0. An attacker able to mount
arbitrary ext4 volumes could use this to cause a denial of service
(memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19768

Tristan Madani reported a race condition in the blktrace debug
facility that could result in a use-after-free. A local user able
to trigger removal of block devices could possibly use this to
cause a denial of service (crash) or for privilege escalation.

CVE-2019-20636

The syzbot tool found that the input subsystem did not fully
validate keycode changes, which could result in a heap
out-of-bounds write. A local user permitted to access the device
node for an input or VT device could possibly use this to cause a
denial of service (crash or memory corruption) or for privilege
escalation.

CVE-2020-0009

Jann Horn reported that the Android ashmem driver did not prevent
read-only files from being memory-mapped and then remapped as
read-write. However, Android drivers are not enabled in Debian
kernel configurations.

CVE-2020-0543

Researchers at VU Amsterdam discovered that on some Intel CPUs
supporting the RDRAND and RDSEED instructions, part of a random
value generated by these instructions may be use ...

Description truncated. Please see the references for more information.

Affected Software/OS:
'linux' package(s) on Debian Linux.

Solution:
For Debian 8 'Jessie', these problems have been fixed in version
3.16.84-1.

We recommend that you upgrade your linux packages. Binary packages for
the EABI ARM (armel) architecture are not yet available, and a separate
announcement will be made when they are.

CVSS Score:
7.2

CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-8839
BugTraq ID: 85798
http://www.securityfocus.com/bid/85798
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
http://www.openwall.com/lists/oss-security/2016/04/01/4
RedHat Security Advisories: RHSA-2017:1842
https://access.redhat.com/errata/RHSA-2017:1842
RedHat Security Advisories: RHSA-2017:2077
https://access.redhat.com/errata/RHSA-2017:2077
RedHat Security Advisories: RHSA-2017:2669
https://access.redhat.com/errata/RHSA-2017:2669
http://www.securitytracker.com/id/1035455
http://www.ubuntu.com/usn/USN-3005-1
http://www.ubuntu.com/usn/USN-3006-1
http://www.ubuntu.com/usn/USN-3007-1
Common Vulnerability Exposure (CVE) ID: CVE-2019-5108
Debian Security Information: DSA-4698 (Google Search)
https://www.debian.org/security/2020/dsa-4698
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html
https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
https://usn.ubuntu.com/4285-1/
https://usn.ubuntu.com/4286-1/
https://usn.ubuntu.com/4286-2/
https://usn.ubuntu.com/4287-1/
https://usn.ubuntu.com/4287-2/
Common Vulnerability Exposure (CVE) ID: CVE-2020-0009
http://packetstormsecurity.com/files/155903/Android-ashmem-Read-Only-Bypasses.html
Common Vulnerability Exposure (CVE) ID: CVE-2020-0543
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DT2VKDMQ3I37NBNJ256A2EXR7OJHXXKZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQZMOSHLTBBIECENNXA6M7DN5FEED4KI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5OUM24ZC43G4IDT3JUCIHJTSDXJSK6Y/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00320.html
http://www.openwall.com/lists/oss-security/2020/07/14/5
SuSE Security Announcement: openSUSE-SU-2020:0818 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00025.html
SuSE Security Announcement: openSUSE-SU-2020:0965 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00024.html
SuSE Security Announcement: openSUSE-SU-2020:0985 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00031.html
https://usn.ubuntu.com/4385-1/
https://usn.ubuntu.com/4387-1/
https://usn.ubuntu.com/4388-1/
https://usn.ubuntu.com/4389-1/
https://usn.ubuntu.com/4390-1/
https://usn.ubuntu.com/4391-1/
https://usn.ubuntu.com/4392-1/
https://usn.ubuntu.com/4393-1/
Common Vulnerability Exposure (CVE) ID: CVE-2020-1749
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1749
Common Vulnerability Exposure (CVE) ID: CVE-2020-2732
Debian Security Information: DSA-4667 (Google Search)
https://www.debian.org/security/2020/dsa-4667
https://bugzilla.redhat.com/show_bug.cgi?id=1805135
https://git.kernel.org/linus/07721feee46b4b248402133228235318199b05ec
https://git.kernel.org/linus/35a571346a94fb93b5b3b6a599675ef3384bc75c
https://git.kernel.org/linus/e71237d3ff1abf9f3388337cfebf53b96df2020d
https://linux.oracle.com/errata/ELSA-2020-5540.html
https://linux.oracle.com/errata/ELSA-2020-5542.html
https://linux.oracle.com/errata/ELSA-2020-5543.html
https://www.openwall.com/lists/oss-security/2020/02/25/3
https://www.spinics.net/lists/kvm/msg208259.html
Common Vulnerability Exposure (CVE) ID: CVE-2020-8647
https://bugzilla.kernel.org/show_bug.cgi?id=206359
SuSE Security Announcement: openSUSE-SU-2020:0388 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00039.html
Common Vulnerability Exposure (CVE) ID: CVE-2020-8648
https://bugzilla.kernel.org/show_bug.cgi?id=206361
SuSE Security Announcement: openSUSE-SU-2020:0336 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
https://usn.ubuntu.com/4342-1/
https://usn.ubuntu.com/4344-1/
https://usn.ubuntu.com/4345-1/
https://usn.ubuntu.com/4346-1/
Common Vulnerability Exposure (CVE) ID: CVE-2020-8649
https://bugzilla.kernel.org/show_bug.cgi?id=206357
Common Vulnerability Exposure (CVE) ID: CVE-2020-9383
https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd61145516171e3
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

This is only one of 85075 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.