linux-lts-quantal vulnerabilities

Version: sendmail < 8.17.1-1.1

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:11:39.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1204696"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openSUSE Factory",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "8.17.1-1.1",
              "status": "affected",
              "version": "sendmail",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Matthias Gerstner and Filippo Bonazzi from SUSE"
        }
      ],
      "datePublic": "2022-10-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Improper Link Resolution Before File Access (\u0027Link Following\u0027) vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-26T00:00:00",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1204696"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1204696",
        "defect": [
          "1204696"
        ],
        "discovery": "INTERNAL"
      },
      "title": "sendmail: mail to root privilege escalation via sm-client.pre script",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2022-31256",
    "datePublished": "2022-10-26T08:55:09.458554Z",
    "dateReserved": "2022-05-20T00:00:00",
    "dateUpdated": "2024-09-16T16:32:57.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-31251

Vulnerability from cvelistv5

Published

2022-09-07 08:55

Modified

2024-09-17 01:10

Severity ?

6.5 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H

Summary

A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3.

References

▼	URL	Tags
	https://bugzilla.suse.com/show_bug.cgi?id=1201674

Impacted products

Vendor

Product

Version

▼

Version: slurm < 22.05.2-3.3

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:11:39.925Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1201674"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openSUSE Factory",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "22.05.2-3.3",
              "status": "affected",
              "version": "slurm",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Johannes Segitz from SUSE"
        }
      ],
      "datePublic": "2022-08-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276: Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-19T00:00:00",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1201674"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1201674",
        "defect": [
          "1201674"
        ],
        "discovery": "INTERNAL"
      },
      "title": "slurm: %post for slurm-testsuite operates as root in user owned directory",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2022-31251",
    "datePublished": "2022-09-07T08:55:09.171815Z",
    "dateReserved": "2022-05-20T00:00:00",
    "dateUpdated": "2024-09-17T01:10:54.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-46705

Vulnerability from cvelistv5

Published

2022-03-16 09:50

Modified

2024-09-16 19:46

Severity ?

5.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Summary

A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.

References

▼	URL	Tags
	https://bugzilla.suse.com/show_bug.cgi?id=1190474	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

SUSE Linux Enterprise Server 15 SP4

Version: grub2 < 2.06-150400.7.1

Version: grub2 < 2.06-18.1

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1190474"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SUSE Linux Enterprise Server 15 SP4",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.06-150400.7.1",
              "status": "affected",
              "version": "grub2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "openSUSE Factory",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.06-18.1",
              "status": "affected",
              "version": "grub2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ludwig Nussel of SUSE"
        }
      ],
      "datePublic": "2022-02-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-377",
              "description": "CWE-377: Insecure Temporary File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-16T09:50:10",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1190474"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1190474",
        "defect": [
          "1190474"
        ],
        "discovery": "INTERNAL"
      },
      "title": "grub2-once uses fixed file name in /var/tmp",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "DATE_PUBLIC": "2022-02-23T00:00:00.000Z",
          "ID": "CVE-2021-46705",
          "STATE": "PUBLIC",
          "TITLE": "grub2-once uses fixed file name in /var/tmp"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SUSE Linux Enterprise Server 15 SP4",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "grub2",
                            "version_value": "2.06-150400.7.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "openSUSE Factory",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "grub2",
                            "version_value": "2.06-18.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Ludwig Nussel of SUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-377: Insecure Temporary File"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1190474",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1190474"
            }
          ]
        },
        "source": {
          "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1190474",
          "defect": [
            "1190474"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2021-46705",
    "datePublished": "2022-03-16T09:50:10.172983Z",
    "dateReserved": "2022-03-09T00:00:00",
    "dateUpdated": "2024-09-16T19:46:27.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-22038

Vulnerability from cvelistv5

Published

2024-11-28 09:38

Modified

2024-11-28 12:15

Severity ?

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service.

References

▼	URL	Tags
	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22038

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-28T12:09:30.908633Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-28T12:15:16.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "obs-scm-bridge",
          "product": "openSUSE Factory",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Gerstner of SUSE"
        }
      ],
      "datePublic": "2024-11-14T10:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service.\u003cbr\u003e"
            }
          ],
          "value": "Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-28T09:38:03.449Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22038"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridge",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2024-22038",
    "datePublished": "2024-11-28T09:38:03.449Z",
    "dateReserved": "2024-01-04T12:38:34.026Z",
    "dateUpdated": "2024-11-28T12:15:16.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-45155

Vulnerability from cvelistv5

Published

2023-03-15 00:00

Modified

2024-08-03 14:09

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

An Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackers that can influence the call to the service to delete files and directories on the system of the victim. This issue affects: SUSE openSUSE Factory obs-service-go_modules versions prior to 0.6.1.

References

▼	URL	Tags
	https://bugzilla.suse.com/show_bug.cgi?id=1201138

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 0.6.1

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:09:56.396Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1201138"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openSUSE Factory",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.6.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Thomas Leroy of SUSE"
        }
      ],
      "datePublic": "2023-03-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackers that can influence the call to the service to delete files and directories on the system of the victim. This issue affects: SUSE openSUSE Factory obs-service-go_modules versions prior to 0.6.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755: Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-15T00:00:00",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1201138"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1201138",
        "defect": [
          "1201138"
        ],
        "discovery": "INTERNAL"
      },
      "title": "obs-service-go_modules: arbitrary directory delete",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2022-45155",
    "datePublished": "2023-03-15T00:00:00",
    "dateReserved": "2022-11-11T00:00:00",
    "dateUpdated": "2024-08-03T14:09:56.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

var-201403-0508

Vulnerability from variot

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk. The Linux kernel is prone to a denial-of-service vulnerability. An attacker can exploit this issue to crash the affected computer, denying service to legitimate users. The NFSv4 implementation is one of the distributed file system protocols. The vulnerability stems from the fact that the program does not verify the auth_enable and auth_capable fields before calling sctp_sf_authenticate. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

===================================================================== Red Hat Security Advisory

Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2014:0419-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0419.html Issue date: 2014-04-22 CVE Names: CVE-2014-0101 =====================================================================

Summary:

Updated kernel packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.3 Extended Update Support.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Relevant releases/architectures:

Red Hat Enterprise Linux Compute Node EUS (v. 6.3) - noarch, x86_64 Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.3) - x86_64 Red Hat Enterprise Linux Server EUS (v. 6.3) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 6.3) - i386, ppc64, s390x, x86_64

A flaw was found in the way the Linux kernel processed an authenticated COOKIE_ECHO chunk during the initialization of an SCTP connection. (CVE-2014-0101, Important)

Red Hat would like to thank Nokia Siemens Networks for reporting this issue.

This update also fixes the following bug:

Due to an incorrect call of the weak-modules script in the kernel spec file, the weak-modules directory was removed from the system when removing or upgrading certain kernel packages related to weak-modules, such as kernel-debug. With this update, the weak-modules call in the kernel spec file has been corrected, and the script now preserves the weak-modules directory on the system in this scenario. (BZ#1076599)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system.

Package List:

Red Hat Enterprise Linux Compute Node EUS (v. 6.3):

Source: kernel-2.6.32-279.43.1.el6.src.rpm

noarch: kernel-doc-2.6.32-279.43.1.el6.noarch.rpm kernel-firmware-2.6.32-279.43.1.el6.noarch.rpm

x86_64: kernel-2.6.32-279.43.1.el6.x86_64.rpm kernel-debug-2.6.32-279.43.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-279.43.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-279.43.1.el6.x86_64.rpm kernel-devel-2.6.32-279.43.1.el6.x86_64.rpm kernel-headers-2.6.32-279.43.1.el6.x86_64.rpm perf-2.6.32-279.43.1.el6.x86_64.rpm perf-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm

Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.3):

Source: kernel-2.6.32-279.43.1.el6.src.rpm

x86_64: kernel-debug-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-279.43.1.el6.x86_64.rpm perf-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm python-perf-2.6.32-279.43.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.x86_64.rpm

Red Hat Enterprise Linux Server EUS (v. 6.3):

Source: kernel-2.6.32-279.43.1.el6.src.rpm

i386: kernel-2.6.32-279.43.1.el6.i686.rpm kernel-debug-2.6.32-279.43.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-279.43.1.el6.i686.rpm kernel-debug-devel-2.6.32-279.43.1.el6.i686.rpm kernel-debuginfo-2.6.32-279.43.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-279.43.1.el6.i686.rpm kernel-devel-2.6.32-279.43.1.el6.i686.rpm kernel-headers-2.6.32-279.43.1.el6.i686.rpm perf-2.6.32-279.43.1.el6.i686.rpm perf-debuginfo-2.6.32-279.43.1.el6.i686.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.i686.rpm

noarch: kernel-doc-2.6.32-279.43.1.el6.noarch.rpm kernel-firmware-2.6.32-279.43.1.el6.noarch.rpm

ppc64: kernel-2.6.32-279.43.1.el6.ppc64.rpm kernel-bootwrapper-2.6.32-279.43.1.el6.ppc64.rpm kernel-debug-2.6.32-279.43.1.el6.ppc64.rpm kernel-debug-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm kernel-debug-devel-2.6.32-279.43.1.el6.ppc64.rpm kernel-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-279.43.1.el6.ppc64.rpm kernel-devel-2.6.32-279.43.1.el6.ppc64.rpm kernel-headers-2.6.32-279.43.1.el6.ppc64.rpm perf-2.6.32-279.43.1.el6.ppc64.rpm perf-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm

s390x: kernel-2.6.32-279.43.1.el6.s390x.rpm kernel-debug-2.6.32-279.43.1.el6.s390x.rpm kernel-debug-debuginfo-2.6.32-279.43.1.el6.s390x.rpm kernel-debug-devel-2.6.32-279.43.1.el6.s390x.rpm kernel-debuginfo-2.6.32-279.43.1.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-279.43.1.el6.s390x.rpm kernel-devel-2.6.32-279.43.1.el6.s390x.rpm kernel-headers-2.6.32-279.43.1.el6.s390x.rpm kernel-kdump-2.6.32-279.43.1.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-279.43.1.el6.s390x.rpm kernel-kdump-devel-2.6.32-279.43.1.el6.s390x.rpm perf-2.6.32-279.43.1.el6.s390x.rpm perf-debuginfo-2.6.32-279.43.1.el6.s390x.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.s390x.rpm

Red Hat Enterprise Linux Server Optional EUS (v. 6.3):

Source: kernel-2.6.32-279.43.1.el6.src.rpm

i386: kernel-debug-debuginfo-2.6.32-279.43.1.el6.i686.rpm kernel-debuginfo-2.6.32-279.43.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-279.43.1.el6.i686.rpm perf-debuginfo-2.6.32-279.43.1.el6.i686.rpm python-perf-2.6.32-279.43.1.el6.i686.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.i686.rpm

ppc64: kernel-debug-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm kernel-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-279.43.1.el6.ppc64.rpm perf-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm python-perf-2.6.32-279.43.1.el6.ppc64.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.ppc64.rpm

s390x: kernel-debug-debuginfo-2.6.32-279.43.1.el6.s390x.rpm kernel-debuginfo-2.6.32-279.43.1.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-279.43.1.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-279.43.1.el6.s390x.rpm perf-debuginfo-2.6.32-279.43.1.el6.s390x.rpm python-perf-2.6.32-279.43.1.el6.s390x.rpm python-perf-debuginfo-2.6.32-279.43.1.el6.s390x.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package

References:

https://www.redhat.com/security/data/cve/CVE-2014-0101.html https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iD8DBQFTVqvnXlSAg2UNWIIRAskwAKDFhD3zS1sh/vhrk31MzjZjFuD8kwCfdeRV 1nSgXH01tADV2vYadphGfKs= =2Sa7 -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . (CVE-2014-2672)

Adhemerval Zanella Neto discovered a flaw the in the Transactional Memory (TM) implementation for powerpc based machine. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2014:124 http://www.mandriva.com/en/support/security/

Package : kernel Date : June 13, 2014 Affected: Business Server 1.0

Problem Description:

Multiple vulnerabilities has been found and corrected in the Linux kernel:

kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number (CVE-2014-3917).

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification (CVE-2014-3153). NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced (CVE-2014-3144). NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced (CVE-2014-3145).

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device (CVE-2014-1737).

Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function (CVE-2012-2137).

The updated packages provides a solution for these security issues. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTmvH3mqjQ0CJFipgRAjgaAKDtCfvK/cukQMyPkhdgllxaobQHFQCdHoJo g42VcK2YoEgcX9BPP3/zfWg= =4uZg -----END PGP SIGNATURE----- . ============================================================================ Ubuntu Security Notice USN-2223-1 May 27, 2014

linux-lts-quantal vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description: - linux-lts-quantal: Linux hardware enablement kernel from Quantal

Details:

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-1738)

Matthew Daley reported a flaw in the handling of ioctl commands by the floppy disk driver in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges if the floppy disk module is loaded. (CVE-2014-1737)

A flaw was discovered in the Linux kernel's IPC reference counting. (CVE-2014-0055)

A flaw was discovered in the handling of network packets when mergeable buffers are disabled for virtual machines in the Linux kernel. Guest OS users may exploit this flaw to cause a denial of service (host OS crash) or possibly gain privilege on the host OS. (CVE-2014-0077)

A flaw was discovered in the Linux kernel's handling of the SCTP handshake. (CVE-2014-0101)

A flaw was discovered in the handling of routing information in Linux kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a denial of service (memory consumption) via a flood of ICMPv6 router advertisement packets. (CVE-2014-2309)

An error was discovered in the Linux kernel's DCCP protocol support. A remote attacked could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2014-2523)

Max Sydorenko discovered a race condition in the Atheros 9k wireless driver in the Linux kernel. (CVE-2014-2672)

An error was discovered in the Reliable Datagram Sockets (RDS) protocol stack in the Linux kernel. (CVE-2014-2678)

Yaara Rozenblum discovered a race condition in the Linux kernel's Generic IEEE 802.11 Networking Stack (mac80211). (CVE-2014-2706)

A flaw was discovered in the Linux kernel's ping sockets. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or possibly gain privileges via a crafted application. (CVE-2014-2851)

Sasha Levin reported a bug in the Linux kernel's virtual memory management subsystem. (CVE-2014-3122)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS: linux-image-3.5.0-51-generic 3.5.0-51.76~precise1

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), a standard system upgrade will automatically perform this as well

Show details on source website