| Description: | Summary:
The remote host is missing an update for the Debian 'linux-2.6' package(s) announced via the DLA-378-1 advisory.
Vulnerability Insight:
This update fixes the CVEs described below.
CVE-2015-7550
Dmitry Vyukov discovered a race condition in the keyring subsystem that allows a local user to cause a denial of service (crash).
CVE-2015-8543
It was discovered that a local user permitted to create raw sockets could cause a denial-of-service by specifying an invalid protocol number for the socket. The attacker must have the CAP_NET_RAW capability.
CVE-2015-8575
David Miller discovered a flaw in the Bluetooth SCO sockets implementation that leads to an information leak to local users.
In addition, this update fixes a regression in the previous update:
#808293 A regression in the UDP implementation prevented freeradius and some other applications from receiving data.
For the oldoldstable distribution (squeeze), these problems have been fixed in version 2.6.32-48squeeze18.
For the oldstable distribution (wheezy), these problems have been fixed in version 3.2.73-2+deb7u2.
For the stable distribution (jessie), these problems have been fixed in version 3.16.7-ckt20-1+deb8u2 or earlier.
Affected Software/OS:
'linux-2.6' package(s) on Debian 6.
Solution:
Please install the updated package(s).
CVSS Score:
6.9
CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C
|
