This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Oracle First view 2014-04-01
Product Linux Last view 2016-08-02
Version 5 Type Os
Update -  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:o:oracle:linux

Activity : Overall

Related : CVE

  Date Alert Description
5.5 2016-08-02 CVE-2016-5403

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

8.8 2016-05-11 CVE-2016-3710

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

5.3 2015-12-06 CVE-2015-3195

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

4.4 2015-03-02 CVE-2015-0239

The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.

2.1 2015-03-02 CVE-2014-9644

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

2.1 2015-03-02 CVE-2013-7421

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.

10 2015-01-28 CVE-2015-0235

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

2.1 2015-01-09 CVE-2014-9584

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.

7.5 2014-11-10 CVE-2014-3687

The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

7.5 2014-11-10 CVE-2014-3673

The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c.

5.5 2014-06-23 CVE-2014-0203

The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.

2.1 2014-05-11 CVE-2014-1738

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.

7.2 2014-05-11 CVE-2014-1737

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.

4.7 2014-04-01 CVE-2014-2678

The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

CWE : Common Weakness Enumeration

%idName
21% (3) CWE-269 Improper Privilege Management
14% (2) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
14% (2) CWE-200 Information Exposure
14% (2) CWE-20 Improper Input Validation
7% (1) CWE-787 Out-of-bounds Write
7% (1) CWE-754 Improper Check for Unusual or Exceptional Conditions
7% (1) CWE-476 NULL Pointer Dereference
7% (1) CWE-416 Use After Free
7% (1) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

Snort® IPS/IDS

Date Description
2016-09-27 WordPress pingback gethostbyname heap buffer overflow attempt
RuleID : 39925 - Type : SERVER-WEBAPP - Revision : 2
2015-07-13 Linux kernel SCTP Unknown Chunk Types denial of service attempt
RuleID : 34802 - Type : OS-LINUX - Revision : 2
2015-03-04 WordPress pingback gethostbyname heap buffer overflow attempt
RuleID : 33275 - Type : SERVER-WEBAPP - Revision : 2
2015-03-04 Exim gethostbyname heap buffer overflow attempt
RuleID : 33226 - Type : SERVER-MAIL - Revision : 3
2015-03-04 Exim gethostbyname heap buffer overflow attempt
RuleID : 33225 - Type : SERVER-MAIL - Revision : 4

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2017-12-04 Name: The remote host is missing a vendor-supplied security patch.
File: check_point_gaia_sk104443.nasl - Type: ACT_GATHER_INFO
2017-05-01 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2016-1026.nasl - Type: ACT_GATHER_INFO
2017-04-03 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2017-0057.nasl - Type: ACT_GATHER_INFO
2017-03-30 Name: The remote OracleVM host is missing a security update.
File: oraclevm_OVMSA-2017-0055.nasl - Type: ACT_GATHER_INFO
2017-01-05 Name: The remote device is missing a vendor-supplied security patch.
File: juniper_jsa10759.nasl - Type: ACT_GATHER_INFO
2016-11-14 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2781-1.nasl - Type: ACT_GATHER_INFO
2016-11-10 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-3125-1.nasl - Type: ACT_GATHER_INFO
2016-11-07 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2725-1.nasl - Type: ACT_GATHER_INFO
2016-10-27 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2016-1234.nasl - Type: ACT_GATHER_INFO
2016-10-26 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2528-1.nasl - Type: ACT_GATHER_INFO
2016-10-26 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2533-1.nasl - Type: ACT_GATHER_INFO
2016-10-26 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2589-1.nasl - Type: ACT_GATHER_INFO
2016-10-26 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2628-1.nasl - Type: ACT_GATHER_INFO
2016-10-12 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2016-1169.nasl - Type: ACT_GATHER_INFO
2016-10-12 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2016-1170.nasl - Type: ACT_GATHER_INFO
2016-09-29 Name: The remote Scientific Linux host is missing one or more security updates.
File: sl_20160927_kvm_on_SL5_x.nasl - Type: ACT_GATHER_INFO
2016-09-28 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2016-1943.nasl - Type: ACT_GATHER_INFO
2016-09-28 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2016-1943.nasl - Type: ACT_GATHER_INFO
2016-09-28 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2016-1943.nasl - Type: ACT_GATHER_INFO
2016-09-09 Name: The remote device is affected by multiple denial of service vulnerabilities.
File: bluecoat_proxy_av_3_5_4_1.nasl - Type: ACT_GATHER_INFO
2016-09-08 Name: The remote host is affected by multiple vulnerabilities.
File: screenos_JSA10733.nasl - Type: ACT_GATHER_INFO
2016-09-02 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2093-1.nasl - Type: ACT_GATHER_INFO
2016-09-02 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-2100-1.nasl - Type: ACT_GATHER_INFO
2016-08-29 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-1698-1.nasl - Type: ACT_GATHER_INFO
2016-08-29 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-1703-1.nasl - Type: ACT_GATHER_INFO