389 lines
18 KiB
JSON
389 lines
18 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20201398",
|
||
"Version": "oval:org.altlinux.errata:def:20201398",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2020-1398: package `kernel-image-un-def` update to version 5.4.22-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p9"
|
||
],
|
||
"Products": [
|
||
"ALT Server",
|
||
"ALT Virtualization Server",
|
||
"ALT Workstation",
|
||
"ALT Workstation K",
|
||
"ALT Education",
|
||
"Simply Linux",
|
||
"Starterkit"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2020-1398",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2020-1398",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05303",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05303",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05304",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05304",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05305",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05305",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05306",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05306",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05307",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05307",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05308",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05308",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05309",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05309",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05310",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05310",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05311",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05311",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05312",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05312",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05313",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05313",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05314",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05314",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05315",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05315",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05542",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05542",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2015-05543",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2015-05543",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-00158",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-00158",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-00851",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-00851",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2013-1798",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-1798",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-19076",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-19076",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-3016",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-3016",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades kernel-image-un-def to version 5.4.22-alt1. \nSecurity Fix(es):\n\n * BDU:2015-05303: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05304: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05305: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05306: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05307: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05308: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05309: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05310: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05311: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05312: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05313: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05314: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05315: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить доступность защищаемой информации\n\n * BDU:2015-05542: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-05543: Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2020-00158: Уязвимость функции nfp_abm_u32_knode_replace() ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-00851: Уязвимость подсистемы виртуализации Kernel-based Virtual Machine (KVM) ядра операционных систем Linux, связанная с одновременным выполнением с использованием общего ресурса с неправильной синхронизацией, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * CVE-2013-1798: The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.\n\n * CVE-2019-19076: A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service (memory consumption), aka CID-78beef629fd9. NOTE: This has been argued as not a valid vulnerability. The upstream commit 78beef629fd9 was reverted\n\n * CVE-2019-3016: In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2023 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2020-02-27"
|
||
},
|
||
"Updated": {
|
||
"Date": "2020-02-27"
|
||
},
|
||
"bdu": [
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05303",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05303"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05304",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05304"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05305",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05305"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05306",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05306"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05307",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05307"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05308",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05308"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05309",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05309"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05310",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05310"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05311",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05311"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05312",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05312"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05313",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05313"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05314",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05314"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05315",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05315"
|
||
},
|
||
{
|
||
"Cvss": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05542",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05542"
|
||
},
|
||
{
|
||
"Cvss": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
|
||
"Href": "https://bdu.fstec.ru/vul/2015-05543",
|
||
"Impact": "High",
|
||
"Public": "19700101",
|
||
"CveID": "BDU:2015-05543"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"Cwe": "CWE-400",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-00158",
|
||
"Impact": "High",
|
||
"Public": "20190927",
|
||
"CveID": "BDU:2020-00158"
|
||
},
|
||
{
|
||
"Cvss": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
|
||
"Cwe": "CWE-200, CWE-362",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-00851",
|
||
"Impact": "Low",
|
||
"Public": "20200131",
|
||
"CveID": "BDU:2020-00851"
|
||
}
|
||
],
|
||
"Cves": [
|
||
{
|
||
"Cvss": "AV:A/AC:H/Au:N/C:C/I:N/A:C",
|
||
"Cwe": "CWE-20",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-1798",
|
||
"Impact": "Low",
|
||
"Public": "20130322",
|
||
"CveID": "CVE-2013-1798"
|
||
},
|
||
{
|
||
"Cvss": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
|
||
"Cvss3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"Cwe": "CWE-401",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-19076",
|
||
"Impact": "Low",
|
||
"Public": "20191118",
|
||
"CveID": "CVE-2019-19076"
|
||
},
|
||
{
|
||
"Cvss": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
|
||
"Cvss3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"Cwe": "CWE-362",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-3016",
|
||
"Impact": "Low",
|
||
"Public": "20200131",
|
||
"CveID": "CVE-2019-3016"
|
||
}
|
||
],
|
||
"AffectedCpeList": {
|
||
"Cpe": [
|
||
"cpe:/o:alt:kworkstation:9",
|
||
"cpe:/o:alt:workstation:9",
|
||
"cpe:/o:alt:server:9",
|
||
"cpe:/o:alt:server-v:9",
|
||
"cpe:/o:alt:education:9",
|
||
"cpe:/o:alt:slinux:9",
|
||
"cpe:/o:alt:starterkit:p9",
|
||
"cpe:/o:alt:kworkstation:9.1",
|
||
"cpe:/o:alt:workstation:9.1",
|
||
"cpe:/o:alt:server:9.1",
|
||
"cpe:/o:alt:server-v:9.1",
|
||
"cpe:/o:alt:education:9.1",
|
||
"cpe:/o:alt:slinux:9.1",
|
||
"cpe:/o:alt:starterkit:9.1",
|
||
"cpe:/o:alt:kworkstation:9.2",
|
||
"cpe:/o:alt:workstation:9.2",
|
||
"cpe:/o:alt:server:9.2",
|
||
"cpe:/o:alt:server-v:9.2",
|
||
"cpe:/o:alt:education:9.2",
|
||
"cpe:/o:alt:slinux:9.2",
|
||
"cpe:/o:alt:starterkit:9.2"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:1001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398001",
|
||
"Comment": "kernel-doc-un is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398002",
|
||
"Comment": "kernel-headers-modules-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398003",
|
||
"Comment": "kernel-headers-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398004",
|
||
"Comment": "kernel-image-domU-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398005",
|
||
"Comment": "kernel-image-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398006",
|
||
"Comment": "kernel-modules-drm-ancient-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398007",
|
||
"Comment": "kernel-modules-drm-nouveau-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398008",
|
||
"Comment": "kernel-modules-drm-radeon-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398009",
|
||
"Comment": "kernel-modules-drm-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398010",
|
||
"Comment": "kernel-modules-ide-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398011",
|
||
"Comment": "kernel-modules-staging-un-def is earlier than 1:5.4.22-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201398012",
|
||
"Comment": "kernel-modules-v4l-un-def is earlier than 1:5.4.22-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |