| Descripción: | Summary:
The remote host is missing an update for the 'kernel'
package(s) announced via the referenced advisory.
Vulnerability Insight:
The openSUSE Leap 42.3 kernel was updated to 4.4.143 to receive various
security and bugfixes.
The following security bugs were fixed:
- CVE-2017-18344: The timer_create syscall implementation in
kernel/time/posix-timers.c didn't properly validate the
sigevent- sigev_notify field, which leads to out-of-bounds access in the
show_timer function (called when /proc/$PID/timers is read). This
allowed userspace applications to read arbitrary kernel memory (on a
kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE)
(bnc#1102851 bnc#1103580).
- CVE-2018-10876: A flaw was found in Linux kernel in the ext4 filesystem
code. A use-after-free is possible in ext4_ext_remove_space() function
when mounting and operating a crafted ext4 image. (bnc#1099811)
- CVE-2018-10877: Linux kernel ext4 filesystem is vulnerable to an
out-of-bound access in the ext4_ext_drop_refs() function when operating
on a crafted ext4 filesystem image. (bnc#1099846)
- CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bounds write and a denial of service or unspecified
other impact is possible by mounting and operating a crafted ext4
filesystem image. (bnc#1099813)
- CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user
can cause a use-after-free in ext4_xattr_set_entry function and a denial
of service or unspecified other impact may occur by renaming a file in a
crafted ext4 filesystem image. (bnc#1099844)
- CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds
write in the ext4 filesystem code when mounting and writing to a crafted
ext4 image in ext4_update_inline_data(). An attacker could use this to
cause a system crash and a denial of service. (bnc#1099845)
- CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bound access in ext4_get_group_info function, a
denial of service, and a system crash by mounting and operating on a
crafted ext4 filesystem image. (bnc#1099864)
- CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bound write in fs/jbd2/transaction.c code, a
denial of service, and a system crash by unmounting a crafted ext4
filesystem image. (bnc#1099849)
- CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a
denial of service, and a system crash by mounting and operating on a
crafted ext4 filesystem image. (bnc#1099863)
- CVE-2018-14734: drivers/infiniband/core/ucma.c allowed
ucma_leave_ ...
Description truncated, please see the referenced URL(s) for more information.
Affected Software/OS:
the on openSUSE Leap 42.3
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
