Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title kernel security and bug fix update
Informations
Name RHSA-2013:1450 First vendor Publication 2013-10-22
Vendor RedHat Last vendor Modification 2013-10-22
Severity (Vendor) Important Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 6.9 Attack Range Local
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 3.4 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 6.3 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Compute Node EUS (v. 6.3) - noarch, x86_64 Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.3) - x86_64 Red Hat Enterprise Linux Server EUS (v. 6.3) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 6.3) - i386, ppc64, s390x, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the fix for CVE-2012-3552 released via RHSA-2012:1540 introduced an invalid free flaw in the Linux kernel's TCP/IP protocol suite implementation. A local, unprivileged user could use this flaw to corrupt kernel memory via crafted sendmsg() calls, allowing them to cause a denial of service or, potentially, escalate their privileges on the system. (CVE-2013-2224, Important)

* An information leak flaw was found in the way Linux kernel's device mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. An attacker could use this flaw to read data from disk blocks in free space, which are normally inaccessible. (CVE-2013-4299, Moderate)

* A format string flaw was found in the b43_do_request_fw() function in the Linux kernel's b43 driver implementation. A local user who is able to specify the "fwpostfix" b43 module parameter could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-2852, Low)

Red Hat would like to thank Fujitsu for reporting CVE-2013-4299, and Kees Cook for reporting CVE-2013-2852.

This update also fixes the following bugs:

* An insufficiently designed calculation in the CPU accelerator could cause an arithmetic overflow in the set_cyc2ns_scale() function if the system uptime exceeded 208 days prior to using kexec to boot into a new kernel. This overflow led to a kernel panic on the systems using the Time Stamp Counter (TSC) clock source, primarily the systems using Intel Xeon E5 processors that do not reset TSC on soft power cycles. A patch has been applied to modify the calculation so that this arithmetic overflow and kernel panic can no longer occur under these circumstances. (BZ#1004185)

* A race condition in the abort task and SPP device task management path of the isci driver could, under certain circumstances, cause the driver to fail cleaning up timed-out I/O requests that were pending on an SAS disk device. As a consequence, the kernel removed such a device from the system. A patch applied to the isci driver fixes this problem by sending the task management function request to the SAS drive anytime the abort function is entered and the task has not completed. The driver now cleans up timed-out I/O requests as expected in this situation. (BZ#1007467)

* A kernel panic could occur during path failover on systems using multiple iSCSI, FC or SRP paths to connect an iSCSI initiator and an iSCSI target. This happened because a race condition in the SCSI driver allowed removing a SCSI device from the system before processing its run queue, which led to a NULL pointer dereference. The SCSI driver has been modified and the race is now avoided by holding a reference to a SCSI device run queue while it is active. (BZ#1008507)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system.

5. Bugs fixed (http://bugzilla.redhat.com/):

969518 - CVE-2013-2852 kernel: b43: format string leaking into error msgs 979936 - CVE-2013-2224 kernel: net: IP_REPOPTS invalid free 1004233 - CVE-2013-4299 kernel: dm: dm-snapshot data leak

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2013-1450.html

CWE : Common Weakness Enumeration

% Id Name
25 % CWE-362 Race Condition
25 % CWE-264 Permissions, Privileges, and Access Controls
25 % CWE-200 Information Exposure
25 % CWE-134 Uncontrolled Format String (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17816
 
Oval ID: oval:org.mitre.oval:def:17816
Title: USN-1914-1 -- linux vulnerability
Description: The system could be made to crash or run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1914-1
CVE-2013-2852
Version: 7
Platform(s): Ubuntu 12.04
Product(s): linux
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18229
 
Oval ID: oval:org.mitre.oval:def:18229
Title: USN-1917-1 -- linux vulnerability
Description: The system could be made to crash or run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1917-1
CVE-2013-2852
Version: 7
Platform(s): Ubuntu 12.10
Product(s): linux
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18240
 
Oval ID: oval:org.mitre.oval:def:18240
Title: USN-1920-1 -- linux-ti-omap4 vulnerability
Description: The system could be made to crash or run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1920-1
CVE-2013-2852
Version: 7
Platform(s): Ubuntu 13.04
Product(s): linux-ti-omap4
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18287
 
Oval ID: oval:org.mitre.oval:def:18287
Title: USN-1915-1 -- linux-lts-quantal vulnerability
Description: The system could be made to crash or run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1915-1
CVE-2013-2852
Version: 7
Platform(s): Ubuntu 12.04
Product(s): linux-lts-quantal
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18351
 
Oval ID: oval:org.mitre.oval:def:18351
Title: USN-1918-1 -- linux-ti-omap4 vulnerability
Description: The system could be made to crash or run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1918-1
CVE-2013-2852
Version: 7
Platform(s): Ubuntu 12.10
Product(s): linux-ti-omap4
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18398
 
Oval ID: oval:org.mitre.oval:def:18398
Title: USN-1916-1 -- linux-lts-raring vulnerability
Description: The system could be made to crash or run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1916-1
CVE-2013-2852
Version: 7
Platform(s): Ubuntu 12.04
Product(s): linux-lts-raring
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18689
 
Oval ID: oval:org.mitre.oval:def:18689
Title: USN-1930-1 -- linux-ti-omap4 vulnerabilities
Description: Several security issues were fixed in the kernel.
Family: unix Class: patch
Reference(s): USN-1930-1
CVE-2013-2148
CVE-2013-2852
Version: 7
Platform(s): Ubuntu 12.04
Product(s): linux-ti-omap4
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18748
 
Oval ID: oval:org.mitre.oval:def:18748
Title: USN-2016-1 -- linux-ec2 vulnerabilities
Description: Several security issues were fixed in the kernel.
Family: unix Class: patch
Reference(s): USN-2016-1
CVE-2013-2147
CVE-2013-2889
CVE-2013-2893
CVE-2013-2897
CVE-2013-4299
Version: 5
Platform(s): Ubuntu 10.04
Product(s): linux-ec2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19067
 
Oval ID: oval:org.mitre.oval:def:19067
Title: USN-2015-1 -- linux vulnerabilities
Description: Several security issues were fixed in the kernel.
Family: unix Class: patch
Reference(s): USN-2015-1
CVE-2013-2147
CVE-2013-2889
CVE-2013-2893
CVE-2013-2897
CVE-2013-4299
Version: 5
Platform(s): Ubuntu 10.04
Product(s): linux
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20291
 
Oval ID: oval:org.mitre.oval:def:20291
Title: RHSA-2013:1860: kernel security and bug fix update (Moderate)
Description: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.
Family: unix Class: patch
Reference(s): RHSA-2013:1860-00
CVE-2013-4299
Version: 6
Platform(s): Red Hat Enterprise Linux 5
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21068
 
Oval ID: oval:org.mitre.oval:def:21068
Title: RHSA-2013:1436: kernel security and bug fix update (Moderate)
Description: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.
Family: unix Class: patch
Reference(s): RHSA-2013:1436-00
CESA-2013:1436
CVE-2013-4162
CVE-2013-4299
Version: 31
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21254
 
Oval ID: oval:org.mitre.oval:def:21254
Title: USN-1899-1 -- linux vulnerabilities
Description: Several security issues were fixed in the kernel.
Family: unix Class: patch
Reference(s): USN-1899-1
CVE-2012-4508
CVE-2013-2141
CVE-2013-2852
Version: 5
Platform(s): Ubuntu 10.04
Product(s): linux
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21303
 
Oval ID: oval:org.mitre.oval:def:21303
Title: USN-1900-1 -- linux-ec2 vulnerabilities
Description: Several security issues were fixed in the kernel.
Family: unix Class: patch
Reference(s): USN-1900-1
CVE-2012-4508
CVE-2013-2141
CVE-2013-2852
Version: 5
Platform(s): Ubuntu 10.04
Product(s): linux-ec2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21577
 
Oval ID: oval:org.mitre.oval:def:21577
Title: RHSA-2012:1304: kernel security and bug fix update (Moderate)
Description: Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
Family: unix Class: patch
Reference(s): RHSA-2012:1304-01
CESA-2012:1304
CVE-2012-2313
CVE-2012-2384
CVE-2012-2390
CVE-2012-3430
CVE-2012-3552
Version: 68
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23299
 
Oval ID: oval:org.mitre.oval:def:23299
Title: VMware ESX updates to third party libraries
Description: A certain Red Hat patch for the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows local users to cause a denial of service (invalid free operation and system crash) or possibly gain privileges via a sendmsg system call with the IP_RETOPTS option, as demonstrated by hemlock.c. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-3552.
Family: unix Class: vulnerability
Reference(s): CVE-2013-2224
Version: 4
Platform(s): VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23417
 
Oval ID: oval:org.mitre.oval:def:23417
Title: ELSA-2013:1860: kernel security and bug fix update (Moderate)
Description: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.
Family: unix Class: patch
Reference(s): ELSA-2013:1860-00
CVE-2013-4299
Version: 6
Platform(s): Oracle Linux 5
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23426
 
Oval ID: oval:org.mitre.oval:def:23426
Title: ELSA-2013:1436: kernel security and bug fix update (Moderate)
Description: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.
Family: unix Class: patch
Reference(s): ELSA-2013:1436-00
CVE-2013-4162
CVE-2013-4299
Version: 13
Platform(s): Oracle Linux 6
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23789
 
Oval ID: oval:org.mitre.oval:def:23789
Title: ELSA-2012:1304: kernel security and bug fix update (Moderate)
Description: Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
Family: unix Class: patch
Reference(s): ELSA-2012:1304-01
CVE-2012-2313
CVE-2012-2384
CVE-2012-2390
CVE-2012-3430
CVE-2012-3552
Version: 25
Platform(s): Oracle Linux 6
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23848
 
Oval ID: oval:org.mitre.oval:def:23848
Title: VMware ESX updates to third party libraries
Description: Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
Family: unix Class: vulnerability
Reference(s): CVE-2012-3552
Version: 4
Platform(s): VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25573
 
Oval ID: oval:org.mitre.oval:def:25573
Title: SUSE-SU-2013:1473-1 -- Security update for Linux kernel
Description: The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to version 3.0.93 and to fix various bugs and security issues.
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1473-1
CVE-2013-2148
CVE-2013-2237
CVE-2013-2232
CVE-2013-2234
CVE-2013-4162
CVE-2013-1059
CVE-2013-2164
CVE-2013-2851
CVE-2013-4163
CVE-2013-1929
CVE-2013-1819
CVE-2013-3301
CVE-2013-2852
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): Linux kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26799
 
Oval ID: oval:org.mitre.oval:def:26799
Title: SUSE-SU-2014:1105-1 -- Security update for the Linux Kernel
Description: The SUSE Linux Enterprise Server 11 SP2 LTSS received a roll up update to fix several security and non-security issues. The following security issues have been fixed: * CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (bnc#870173) * CVE-2014-0077: drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (bnc#870576) * CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call. (bnc#882804) * CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (bnc#871797) * CVE-2014-2851: Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (bnc#873374) * CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced. (bnc#877257) * CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. (bnc#877257) * CVE-2014-3917: kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. (bnc#880484) * CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (bnc#883724) * CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. (bnc#883795) * CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. (bnc#883795) * CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. (bnc#883795) * CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. (bnc#883795) * CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. (bnc#883795) * CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. (bnc#885422) * CVE-2014-4699: The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls. (bnc#885725) * CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction. (bnc#889173) * CVE-2013-4299: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device. (bnc#846404) The following bugs have been fixed: * pagecachelimit: reduce lru_lock contention for heavy parallel reclaim (bnc#878509, bnc#864464). * pagecachelimit: reduce lru_lock contention for heavy parallel reclaim kabi fixup (bnc#878509, bnc#864464). * ACPI / PAD: call schedule() when need_resched() is true (bnc#866911). * kabi: Fix breakage due to addition of user_ctl_lock (bnc#883795). * cpuset: Fix memory allocator deadlock (bnc#876590). * tcp: allow to disable cwnd moderation in TCP_CA_Loss state (bnc#879921). * tcp: adapt selected parts of RFC 5682 and PRR logic (bnc#879921). * vlan: more careful checksum features handling (bnc#872634). * bonding: fix vlan_features computing (bnc#872634). * NFSv4: Minor cleanups for nfs4_handle_exception and nfs4_async_handle_error (bnc#889324). * NFS: Do not lose sockets when nfsd shutdown races with connection timeout (bnc#871854). * reiserfs: call truncate_setsize under tailpack mutex (bnc#878115). * reiserfs: drop vmtruncate (bnc#878115). * megaraid_sas: mask off flags in ioctl path (bnc#886474). * block: fix race between request completion and timeout handling (bnc#881051). * drivers/rtc/interface.c: fix infinite loop in initializing the alarm (bnc#871676). * xfrm: check peer pointer for null before calling inet_putpeer() (bnc#877775). * supported.conf: Add firewire/nosy as supported. This driver is the replacement for the ieee1394/pcilynx driver, which was supported. Security Issues: * CVE-2013-4299 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4299> * CVE-2014-0055 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0055> * CVE-2014-0077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0077> * CVE-2014-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1739> * CVE-2014-2706 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706> * CVE-2014-2851 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2851> * CVE-2014-3144 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3144> * CVE-2014-3145 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3145> * CVE-2014-3917 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3917> * CVE-2014-4508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508> * CVE-2014-4652 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4652> * CVE-2014-4653 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4653> * CVE-2014-4654 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4654> * CVE-2014-4655 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4655> * CVE-2014-4656 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4656> * CVE-2014-4667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667> * CVE-2014-4699 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4699> * CVE-2014-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077>
Family: unix Class: patch
Reference(s): SUSE-SU-2014:1105-1
CVE-2014-0055
CVE-2014-0077
CVE-2014-1739
CVE-2014-2706
CVE-2014-2851
CVE-2014-3144
CVE-2014-3145
CVE-2014-3917
CVE-2014-4508
CVE-2014-4652
CVE-2014-4653
CVE-2014-4654
CVE-2014-4655
CVE-2014-4656
CVE-2014-4667
CVE-2014-4699
CVE-2014-5077
CVE-2013-4299
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
Product(s): the Linux Kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26968
 
Oval ID: oval:org.mitre.oval:def:26968
Title: ELSA-2013-2576 -- unbreakable enterprise kernel security update (moderate)
Description: [2.6.39-400.209.2] - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17618492] {CVE-2013-4299}
Family: unix Class: patch
Reference(s): ELSA-2013-2576
CVE-2013-4299
Version: 3
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): kernel-uek
kernel-uek-debug
kernel-uek-debug-devel
kernel-uek-devel
kernel-uek-doc
kernel-uek-firmware
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27289
 
Oval ID: oval:org.mitre.oval:def:27289
Title: DEPRECATED: ELSA-2013-1436 -- kernel security and bug fix update (moderate)
Description: [2.6.32-358.23.2] - [md] dm-snapshot: fix data corruption (Mikulas Patocka) [1004252 1004233] {CVE-2013-4299}
Family: unix Class: patch
Reference(s): ELSA-2013-1436
CVE-2013-4162
CVE-2013-4299
Version: 4
Platform(s): Oracle Linux 6
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27378
 
Oval ID: oval:org.mitre.oval:def:27378
Title: ELSA-2013-2575 -- unbreakable enterprise kernel security update (moderate)
Description: kernel-uek [2.6.32-400.33.2] - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17618900] {CVE-2013-4299} - ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17618897] {CVE-2013-4162}
Family: unix Class: patch
Reference(s): ELSA-2013-2575
CVE-2013-4162
CVE-2013-4299
Version: 5
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): kernel-uek
mlnx_en
ofa
kernel-uek-debug
kernel-uek-debug-devel
kernel-uek-devel
kernel-uek-doc
kernel-uek-firmware
kernel-uek-headers
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27502
 
Oval ID: oval:org.mitre.oval:def:27502
Title: ELSA-2013-2577 -- unbreakable enterprise kernel security update (moderate)
Description: kernel-uek [3.8.13-16.1.1.el6uek] - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17617582] {CVE-2013-4299}
Family: unix Class: patch
Reference(s): ELSA-2013-2577
CVE-2013-4299
Version: 5
Platform(s): Oracle Linux 6
Product(s): dtrace-modules
kernel-uek
dtrace-modules-3.8.13-16.1.1.el6uek-provider-headers
kernel-uek-debug
kernel-uek-debug-devel
kernel-uek-devel
kernel-uek-doc
kernel-uek-firmware
kernel-uek-headers
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Os 4
Os 1
Os 1986
Os 1
Os 1

OpenVAS Exploits

Date Description
2012-12-06 Name : CentOS Update for kernel CESA-2012:1540 centos5
File : nvt/gb_CESA-2012_1540_kernel_centos5.nasl
2012-12-06 Name : RedHat Update for kernel RHSA-2012:1540-01
File : nvt/gb_RHSA-2012_1540-01_kernel.nasl
2012-09-27 Name : CentOS Update for kernel CESA-2012:1304 centos6
File : nvt/gb_CESA-2012_1304_kernel_centos6.nasl
2012-09-27 Name : RedHat Update for kernel RHSA-2012:1304-01
File : nvt/gb_RHSA-2012_1304-01_kernel.nasl

Nessus® Vulnerability Scanner

Date Description
2017-04-03 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2017-0057.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_esx_VMSA-2013-0015_remote.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0812-1.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0652-1.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2014-1105-1.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2014-0287-1.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2012-1325.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1076.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1181.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1860.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1783.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1519.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1460.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1450.nasl - Type : ACT_GATHER_INFO
2014-07-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1490.nasl - Type : ACT_GATHER_INFO
2014-07-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1264.nasl - Type : ACT_GATHER_INFO
2014-07-17 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-140709.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-1034.nasl - Type : ACT_GATHER_INFO
2014-04-27 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2906.nasl - Type : ACT_GATHER_INFO
2014-02-13 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-3002.nasl - Type : ACT_GATHER_INFO
2014-01-05 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2066-1.nasl - Type : ACT_GATHER_INFO
2013-12-09 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2049-1.nasl - Type : ACT_GATHER_INFO
2013-12-06 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2013-0015.nasl - Type : ACT_GATHER_INFO
2013-12-04 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2040-1.nasl - Type : ACT_GATHER_INFO
2013-12-04 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2041-1.nasl - Type : ACT_GATHER_INFO
2013-12-04 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2042-1.nasl - Type : ACT_GATHER_INFO
2013-12-04 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2043-1.nasl - Type : ACT_GATHER_INFO
2013-12-04 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2045-1.nasl - Type : ACT_GATHER_INFO
2013-11-09 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2016-1.nasl - Type : ACT_GATHER_INFO
2013-11-09 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2015-1.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2577.nasl - Type : ACT_GATHER_INFO
2013-10-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1449.nasl - Type : ACT_GATHER_INFO
2013-10-24 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1449.nasl - Type : ACT_GATHER_INFO
2013-10-24 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1449-1.nasl - Type : ACT_GATHER_INFO
2013-10-24 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131022_kernel_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-24 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-233.nasl - Type : ACT_GATHER_INFO
2013-10-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1449.nasl - Type : ACT_GATHER_INFO
2013-10-20 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2576.nasl - Type : ACT_GATHER_INFO
2013-10-20 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2575.nasl - Type : ACT_GATHER_INFO
2013-10-18 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131016_kernel_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-10-18 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1436.nasl - Type : ACT_GATHER_INFO
2013-10-17 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1436.nasl - Type : ACT_GATHER_INFO
2013-10-17 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1436.nasl - Type : ACT_GATHER_INFO
2013-10-01 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-218.nasl - Type : ACT_GATHER_INFO
2013-09-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2766.nasl - Type : ACT_GATHER_INFO
2013-09-21 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-130828.nasl - Type : ACT_GATHER_INFO
2013-09-18 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2546.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-133.nasl - Type : ACT_GATHER_INFO
2013-08-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2745.nasl - Type : ACT_GATHER_INFO
2013-08-29 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130827_kernel_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-08-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1173.nasl - Type : ACT_GATHER_INFO
2013-08-28 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1173.nasl - Type : ACT_GATHER_INFO
2013-08-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1173.nasl - Type : ACT_GATHER_INFO
2013-08-23 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1166-1.nasl - Type : ACT_GATHER_INFO
2013-08-23 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1166.nasl - Type : ACT_GATHER_INFO
2013-08-22 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130820_kernel_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-08-22 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1166.nasl - Type : ACT_GATHER_INFO
2013-08-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1166.nasl - Type : ACT_GATHER_INFO
2013-08-21 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1936-1.nasl - Type : ACT_GATHER_INFO
2013-07-30 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1915-1.nasl - Type : ACT_GATHER_INFO
2013-07-30 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1916-1.nasl - Type : ACT_GATHER_INFO
2013-07-30 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1917-1.nasl - Type : ACT_GATHER_INFO
2013-07-30 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1914-1.nasl - Type : ACT_GATHER_INFO
2013-07-30 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1919-1.nasl - Type : ACT_GATHER_INFO
2013-07-19 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2538.nasl - Type : ACT_GATHER_INFO
2013-07-19 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2537.nasl - Type : ACT_GATHER_INFO
2013-07-18 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130716_kernel_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-07-18 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1051.nasl - Type : ACT_GATHER_INFO
2013-07-17 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1051.nasl - Type : ACT_GATHER_INFO
2013-07-17 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1051.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1540-1.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Fedora host is missing a security update.
File : fedora_2013-10689.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Fedora host is missing a security update.
File : fedora_2013-10695.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Fedora host is missing a security update.
File : fedora_2013-9123.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-194.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1304.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1540.nasl - Type : ACT_GATHER_INFO
2013-07-05 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1900-1.nasl - Type : ACT_GATHER_INFO
2013-07-05 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1899-1.nasl - Type : ACT_GATHER_INFO
2013-05-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2668.nasl - Type : ACT_GATHER_INFO
2012-12-07 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1540.nasl - Type : ACT_GATHER_INFO
2012-12-07 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20121204_kernel_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-12-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1540.nasl - Type : ACT_GATHER_INFO
2012-09-27 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120925_kernel_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-09-27 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1304.nasl - Type : ACT_GATHER_INFO
2012-09-26 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1304.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2014-11-08 13:32:03
  • Multiple Updates
2013-10-24 17:24:30
  • Multiple Updates
2013-10-22 21:21:20
  • First insertion