168 lines
6.8 KiB
JSON
168 lines
6.8 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:20162226",
|
|
"Version": "oval:org.altlinux.errata:def:20162226",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2016-2226: package `kernel-image-std-def` update to version 4.4.30-alt1",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch p9"
|
|
],
|
|
"Products": [
|
|
"ALT Server",
|
|
"ALT Virtualization Server",
|
|
"ALT Workstation",
|
|
"ALT Workstation K",
|
|
"ALT Education",
|
|
"Simply Linux",
|
|
"Starterkit"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2016-2226",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2016-2226",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2016-8666",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-8666",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2016-9644",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-9644",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2017-7273",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-7273",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades kernel-image-std-def to version 4.4.30-alt1. \nSecurity Fix(es):\n\n * CVE-2016-8666: The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.\n\n * CVE-2016-9644: The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels.\n\n * CVE-2017-7273: The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report.",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "High",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2016-11-01"
|
|
},
|
|
"Updated": {
|
|
"Date": "2016-11-01"
|
|
},
|
|
"BDUs": null,
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2016-8666",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
|
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"CWE": "CWE-400",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-8666",
|
|
"Impact": "High",
|
|
"Public": "20161016"
|
|
},
|
|
{
|
|
"ID": "CVE-2016-9644",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"CVSS3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"CWE": "CWE-264",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-9644",
|
|
"Impact": "High",
|
|
"Public": "20161128"
|
|
},
|
|
{
|
|
"ID": "CVE-2017-7273",
|
|
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
|
"CVSS3": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-7273",
|
|
"Impact": "Low",
|
|
"Public": "20170327"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:kworkstation:9",
|
|
"cpe:/o:alt:workstation:9",
|
|
"cpe:/o:alt:server:9",
|
|
"cpe:/o:alt:server-v:9",
|
|
"cpe:/o:alt:education:9",
|
|
"cpe:/o:alt:slinux:9",
|
|
"cpe:/o:alt:starterkit:p9"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:1001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226001",
|
|
"Comment": "kernel-doc-std is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226002",
|
|
"Comment": "kernel-headers-modules-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226003",
|
|
"Comment": "kernel-headers-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226004",
|
|
"Comment": "kernel-image-domU-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226005",
|
|
"Comment": "kernel-image-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226006",
|
|
"Comment": "kernel-modules-drm-nouveau-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226007",
|
|
"Comment": "kernel-modules-drm-radeon-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226008",
|
|
"Comment": "kernel-modules-drm-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226009",
|
|
"Comment": "kernel-modules-ide-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226010",
|
|
"Comment": "kernel-modules-kvm-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226011",
|
|
"Comment": "kernel-modules-staging-std-def is earlier than 1:4.4.30-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20162226012",
|
|
"Comment": "kernel-modules-v4l-std-def is earlier than 1:4.4.30-alt1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |