| Beschreibung: | Summary:
The remote host is missing an update for the 'Linux'
package(s) announced via the referenced advisory.
Vulnerability Insight:
The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix
various bugs and security issues.
The following security bugs have been fixed:
* CVE-2012-4398: The __request_module function in kernel/kmod.c in the
Linux kernel before 3.4 did not set a certain killable attribute,
which allowed local users to cause a denial of service (memory
consumption) via a crafted application (bnc#779488).
* CVE-2013-2889: drivers/hid/hid-zpff.c in the Human Interface Device
(HID) subsystem in the Linux kernel through 3.11, when
CONFIG_HID_ZEROPLUS is enabled, allowed physically proximate
attackers to cause a denial of service (heap-based out-of-bounds
write) via a crafted device (bnc#835839).
* CVE-2013-2893: The Human Interface Device (HID) subsystem in the
Linux kernel through 3.11, when CONFIG_LOGITECH_FF,
CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allowed
physically proximate attackers to cause a denial of service
(heap-based out-of-bounds write) via a crafted device, related to
(1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3)
drivers/hid/hid-lg4ff.c (bnc#835839).
* CVE-2013-2897: Multiple array index errors in
drivers/hid/hid-multitouch.c in the Human Interface Device (HID)
subsystem in the Linux kernel through 3.11, when
CONFIG_HID_MULTITOUCH is enabled, allowed physically proximate
attackers to cause a denial of service (heap memory corruption, or
NULL pointer dereference and OOPS) via a crafted device (bnc#835839).
* CVE-2013-2899: drivers/hid/hid-picolcd_core.c in the Human Interface
Device (HID) subsystem in the Linux kernel through 3.11, when
CONFIG_HID_PICOLCD is enabled, allowed physically proximate
attackers to cause a denial of service (NULL pointer dereference and
OOPS) via a crafted device (bnc#835839).
* CVE-2013-7263: The Linux kernel before 3.12.4 updates certain length
values before ensuring that associated data structures have been
initialized, which allowed local users to obtain sensitive
information from kernel stack memory via a (1) recvfrom, (2)
recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c,
net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c
(bnc#853040, bnc#857643).
* CVE-2014-3181: Multiple stack-based buffer overflows in the
magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the
Magic Mouse HID driver in the Linux kernel through 3.16.3 allowed
physically proximate attackers to cause a denial of service (system
crash) or possibly execute arbitrary code via a crafted device that
prov ...
Description truncated, please see the referenced URL(s) for more information.
Affected Software/OS:
Linux on SUSE Linux Enterprise Server 11 SP3
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
