Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.891771
Category:Debian Local Security Checks
Title:Debian LTS: Security Advisory for linux-4.9 (DLA-1771-1)
Summary:The remote host is missing an update for the 'linux-4.9'; package(s) announced via the DLA-1771-1 advisory.
Description:Summary:
The remote host is missing an update for the 'linux-4.9'
package(s) announced via the DLA-1771-1 advisory.

Vulnerability Insight:
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

CVE-2018-14625

A use-after-free bug was found in the vhost driver for the Virtual
Socket protocol. If this driver is used to communicate with a
malicious virtual machine guest, the guest could read sensitive
information from the host kernel.

CVE-2018-16884

A flaw was found in the NFS 4.1 client implementation. Mounting
NFS shares in multiple network namespaces at the same time could
lead to a user-after-free. Local users might be able to use this
for denial of service (memory corruption or crash) or possibly
for privilege escalation.

This can be mitigated by disabling unprivileged users from
creating user namespaces, which is the default in Debian.

CVE-2018-19824

Hui Peng and Mathias Payer discovered a use-after-free bug in the
USB audio driver. A physically present attacker able to attach a
specially designed USB device could use this for privilege
escalation.

CVE-2018-19985

Hui Peng and Mathias Payer discovered a missing bounds check in the
hso USB serial driver. A physically present user able to attach a
specially designed USB device could use this to read sensitive
information from the kernel or to cause a denial of service
(crash).

CVE-2018-20169

Hui Peng and Mathias Payer discovered missing bounds checks in the
USB core. A physically present attacker able to attach a specially
designed USB device could use this to cause a denial of service
(crash) or possibly for privilege escalation.

CVE-2018-1000026

It was discovered that Linux could forward aggregated network
packets with a segmentation size too large for the output device.
In the specific case of Broadcom NetXtremeII 10Gb adapters, this
would result in a denial of service (firmware crash). This update
adds a mitigation to the bnx2x driver for this hardware.

CVE-2019-3459, CVE-2019-3460

Shlomi Oberman, Yuli Shapiro and Karamba Security Ltd. research
team discovered missing range checks in the Bluetooth L2CAP
implementation. If Bluetooth is enabled, a nearby attacker
could use these to read sensitive information from the kernel.

CVE-2019-3701

Muyu Yu and Marcus Meissner reported that the CAN gateway
implementation allowed the frame length to be modified, typically
resulting in out-of-bounds memory-mapped I/O writes. On a system
with CAN devices present, a local user with CAP_NET_ADMIN
capability in the initial net namespace could use this to cause a
crash (oops) or other hardware-dependent impact.

CVE-2019-3819

A potential infinite loop was discovered in the HID debugfs
interface exposed under ...

Description truncated. Please see the references for more information.

Affected Software/OS:
'linux-4.9' package(s) on Debian Linux.

Solution:
For Debian 8 'Jessie', these problems have been fixed in version
4.9.168-1~
deb8u1. This version also includes fixes for Debian bugs
#904385, #918103, and #922306, and other fixes included in upstream
stable updates.

We recommend that you upgrade your linux-4.9 and linux-latest-4.9
packages. You will need to use 'apt-get upgrade --with-new-pkgs'
or 'apt upgrade' as the binary package names have changed.

CVSS Score:
7.8

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2019-3459
https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html
https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html
https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html
https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/
https://marc.info/?l=oss-security&m=154721580222522&w=2
http://www.openwall.com/lists/oss-security/2019/06/27/2
http://www.openwall.com/lists/oss-security/2019/06/27/7
http://www.openwall.com/lists/oss-security/2019/06/28/1
http://www.openwall.com/lists/oss-security/2019/06/28/2
http://www.openwall.com/lists/oss-security/2019/08/12/1
RedHat Security Advisories: RHSA-2019:2029
https://access.redhat.com/errata/RHSA-2019:2029
RedHat Security Advisories: RHSA-2019:2043
https://access.redhat.com/errata/RHSA-2019:2043
RedHat Security Advisories: RHSA-2019:3309
https://access.redhat.com/errata/RHSA-2019:3309
RedHat Security Advisories: RHSA-2019:3517
https://access.redhat.com/errata/RHSA-2019:3517
RedHat Security Advisories: RHSA-2020:0740
https://access.redhat.com/errata/RHSA-2020:0740
Common Vulnerability Exposure (CVE) ID: CVE-2019-3460
https://lore.kernel.org/linux-bluetooth/20190110062917.GB15047@kroah.com/
Common Vulnerability Exposure (CVE) ID: CVE-2019-3701
BugTraq ID: 106443
http://www.securityfocus.com/bid/106443
https://bugzilla.suse.com/show_bug.cgi?id=1120386
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=0aaa81377c5a01f686bcdb8c7a6929a7bf330c68
https://marc.info/?l=linux-netdev&m=154651842302479&w=2
https://marc.info/?l=linux-netdev&m=154661373531512&w=2
https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html
https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
SuSE Security Announcement: openSUSE-SU-2020:0543 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html
https://usn.ubuntu.com/3932-1/
https://usn.ubuntu.com/3932-2/
https://usn.ubuntu.com/4115-1/
https://usn.ubuntu.com/4118-1/
Common Vulnerability Exposure (CVE) ID: CVE-2019-3819
BugTraq ID: 106730
http://www.securityfocus.com/bid/106730
SuSE Security Announcement: openSUSE-SU-2019:1193 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html
Common Vulnerability Exposure (CVE) ID: CVE-2019-6974
BugTraq ID: 107127
http://www.securityfocus.com/bid/107127
https://www.exploit-db.com/exploits/46388/
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cfa39381173d5f969daf43582c95ad679189cbc9
https://bugs.chromium.org/p/project-zero/issues/detail?id=1765
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.99
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.156
https://github.com/torvalds/linux/commit/cfa39381173d5f969daf43582c95ad679189cbc9
RedHat Security Advisories: RHBA-2019:0959
https://access.redhat.com/errata/RHBA-2019:0959
RedHat Security Advisories: RHSA-2019:0818
https://access.redhat.com/errata/RHSA-2019:0818
RedHat Security Advisories: RHSA-2019:0833
https://access.redhat.com/errata/RHSA-2019:0833
RedHat Security Advisories: RHSA-2019:2809
https://access.redhat.com/errata/RHSA-2019:2809
RedHat Security Advisories: RHSA-2019:3967
https://access.redhat.com/errata/RHSA-2019:3967
RedHat Security Advisories: RHSA-2020:0103
https://access.redhat.com/errata/RHSA-2020:0103
https://usn.ubuntu.com/3930-1/
https://usn.ubuntu.com/3930-2/
https://usn.ubuntu.com/3931-1/
https://usn.ubuntu.com/3931-2/
https://usn.ubuntu.com/3933-1/
https://usn.ubuntu.com/3933-2/
Common Vulnerability Exposure (CVE) ID: CVE-2019-7221
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KDOXCX3QFVWYXH5CQMGDDE7H6MUG5XGG/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y2HMABEMJDPA6LPCBE5WIEZXUKY7DLTN/
http://packetstormsecurity.com/files/151713/KVM-VMX-Preemption-Timer-Use-After-Free.html
https://github.com/torvalds/linux/commits/master/arch/x86/kvm
[oss-security] 20190218 Linux kernel: three KVM bugs (CVE-2019-6974, CVE-2019-7221, CVE-2019-7222)
http://www.openwall.com/lists/oss-security/2019/02/18/2
RedHat Security Advisories: RHSA-2019:4058
https://access.redhat.com/errata/RHSA-2019:4058
SuSE Security Announcement: SUSE-SA-2019:0203-1 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00042.html
Common Vulnerability Exposure (CVE) ID: CVE-2019-7222
BugTraq ID: 106963
http://www.securityfocus.com/bid/106963
http://packetstormsecurity.com/files/151712/KVM-kvm_inject_page_fault-Uninitialized-Memory-Leak.html
Common Vulnerability Exposure (CVE) ID: CVE-2019-8980
BugTraq ID: 107120
http://www.securityfocus.com/bid/107120
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1935698.html
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1935705.html
Common Vulnerability Exposure (CVE) ID: CVE-2019-9213
BugTraq ID: 107296
http://www.securityfocus.com/bid/107296
https://www.exploit-db.com/exploits/46502/
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0a1d52994d440e21def1c2174932410b4f2a98a1
http://packetstormsecurity.com/files/156053/Reliable-Datagram-Sockets-RDS-rds_atomic_free_op-Privilege-Escalation.html
https://bugs.chromium.org/p/project-zero/issues/detail?id=1792
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.105
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.27
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.14
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.162
https://github.com/torvalds/linux/commit/0a1d52994d440e21def1c2174932410b4f2a98a1
RedHat Security Advisories: RHSA-2019:0831
https://access.redhat.com/errata/RHSA-2019:0831
RedHat Security Advisories: RHSA-2019:1479
https://access.redhat.com/errata/RHSA-2019:1479
RedHat Security Advisories: RHSA-2019:1480
https://access.redhat.com/errata/RHSA-2019:1480
SuSE Security Announcement: openSUSE-SU-2019:1085 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00045.html
CopyrightCopyright (C) 2019 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.