ID de Prueba:	1.3.6.1.4.1.25623.1.0.852506
Categoría:	SuSE Local Security Checks
Título:	openSUSE: Security Advisory for the Linux Kernel (openSUSE-SU-2019:1407-1)
Resumen:	The remote host is missing an update for the 'Linux Kernel'; package(s) announced via the openSUSE-SU-2019:1407-1 advisory.
Descripción:	Summary: The remote host is missing an update for the 'Linux Kernel' package(s) announced via the openSUSE-SU-2019:1407-1 advisory. Vulnerability Insight: The openSUSE Leap 42.3 kernel was updated to 4.4.179 to receive various security and bugfixes. Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel. The following security bugs were fixed: - CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480). - CVE-2018-10853: A flaw was found in the way Linux kernel KVM hypervisor emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest (bnc#1097104). - CVE-2018-15594: arch/x86/kernel/paravirt.c in the Linux kernel mishandled certain indirect calls, which made it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests (bnc#1105348 1119974). - CVE-2018-17972: An issue was discovered in the proc_pid_stack function in fs/proc/base.c that did not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents (bnc#1110785). - CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728) - CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c had multiple race conditions (bnc#1133188). It has been disabled. - CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c, a race condition leading to a use-after-free was fixed, related to net namespace cleanup (bnc#1134537). - CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c allowed a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD ... Description truncated. Please see the references for more information. Affected Software/OS: 'the' package(s) on openSUSE Leap 42.3. Solution: Please install the updated package(s). CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2018-5814 https://secuniaresearch.flexerasoftware.com/secunia_research/2018-8/ https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html http://www.securitytracker.com/id/1041050 https://secuniaresearch.flexerasoftware.com/advisories/81540/ SuSE Security Announcement: openSUSE-SU-2019:1407 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html https://usn.ubuntu.com/3696-1/ https://usn.ubuntu.com/3696-2/ https://usn.ubuntu.com/3752-1/ https://usn.ubuntu.com/3752-2/ https://usn.ubuntu.com/3752-3/ Common Vulnerability Exposure (CVE) ID: CVE-2019-3882 Bugtraq: 20190813 [SECURITY] [DSA 4497-1] linux security update (Google Search) https://seclists.org/bugtraq/2019/Aug/18 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3882 https://security.netapp.com/advisory/ntap-20190517-0005/ Debian Security Information: DSA-4497 (Google Search) https://www.debian.org/security/2019/dsa-4497 https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html RedHat Security Advisories: RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2029 RedHat Security Advisories: RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2019:2043 RedHat Security Advisories: RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3309 RedHat Security Advisories: RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3517 SuSE Security Announcement: openSUSE-SU-2019:1404 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html SuSE Security Announcement: openSUSE-SU-2019:1479 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html https://usn.ubuntu.com/3979-1/ https://usn.ubuntu.com/3980-1/ https://usn.ubuntu.com/3980-2/ https://usn.ubuntu.com/3981-1/ https://usn.ubuntu.com/3981-2/ https://usn.ubuntu.com/3982-1/ https://usn.ubuntu.com/3982-2/ Common Vulnerability Exposure (CVE) ID: CVE-2019-9503 https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4176ec356c73a46c07c181c6d04039fafa34a9f https://kb.cert.org/vuls/id/166939/
Copyright	Copyright (C) 2019 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.