pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b1153fc0bf
vuln-list-alt/oval/c9f2/ALT-PU-2019-2063/definitions.json
pepelyaevip 56bb29c44b ALT Vulnerability
2024-06-28 13:17:52 +00:00

289 lines
15 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20192063",
"Version": "oval:org.altlinux.errata:def:20192063",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2019-2063: package `kernel-image-std-def` update to version 4.19.49-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c9f2"
],
"Products": [
"ALT SPWorkstation",
"ALT SPServer"
]
}
],
"References": [
{
"RefID": "ALT-PU-2019-2063",
"RefURL": "https://errata.altlinux.org/ALT-PU-2019-2063",
"Source": "ALTPU"
},
{
"RefID": "BDU:2019-01957",
"RefURL": "https://bdu.fstec.ru/vul/2019-01957",
"Source": "BDU"
},
{
"RefID": "BDU:2019-01958",
"RefURL": "https://bdu.fstec.ru/vul/2019-01958",
"Source": "BDU"
},
{
"RefID": "BDU:2019-01959",
"RefURL": "https://bdu.fstec.ru/vul/2019-01959",
"Source": "BDU"
},
{
"RefID": "BDU:2019-01960",
"RefURL": "https://bdu.fstec.ru/vul/2019-01960",
"Source": "BDU"
},
{
"RefID": "BDU:2019-02780",
"RefURL": "https://bdu.fstec.ru/vul/2019-02780",
"Source": "BDU"
},
{
"RefID": "BDU:2020-02044",
"RefURL": "https://bdu.fstec.ru/vul/2020-02044",
"Source": "BDU"
},
{
"RefID": "CVE-2018-12126",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-12126",
"Source": "CVE"
},
{
"RefID": "CVE-2018-12127",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-12127",
"Source": "CVE"
},
{
"RefID": "CVE-2018-12130",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-12130",
"Source": "CVE"
},
{
"RefID": "CVE-2019-11091",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-11091",
"Source": "CVE"
},
{
"RefID": "CVE-2019-11833",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-11833",
"Source": "CVE"
},
{
"RefID": "CVE-2019-9500",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-9500",
"Source": "CVE"
}
],
"Description": "This update upgrades kernel-image-std-def to version 4.19.49-alt1. \nSecurity Fix(es):\n\n * BDU:2019-01957: Уязвимость процессоров Intel, связанная с микроархитектурной выборкой данных некэшируемой памяти (MDSUM), позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2019-01958: Уязвимость порта загрузки MLPDS микропрограммного обеспечения Intel, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальной информации\n\n * BDU:2019-01959: Уязвимость процессоров Intel, связанная с восстановлением содержимого буферов заполнения (MFBDS), позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2019-01960: Уязвимость буфера данных MSBDS микропрограммного обеспечения Intel, позволяющая нарушителю получить доступ к конфиденциальной информации\n\n * BDU:2019-02780: Уязвимость файла fs/ext4/extents.c ядра операционной системы Linux, позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2020-02044: Уязвимость функции brcmf_wowl_nd_results драйвер Broadcom brcmfmac WiFi ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к информации и нарушить ее целостность и доступность\n\n * CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2018-12127: Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2018-12130: Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2019-11833: fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.\n\n * CVE-2019-9500: The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2019-06-14"
},
"Updated": {
"Date": "2019-06-14"
},
"BDUs": [
{
"ID": "BDU:2019-01957",
"CVSS": "AV:L/AC:H/Au:S/C:C/I:N/A:N",
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"CWE": "CWE-203, CWE-385",
"Href": "https://bdu.fstec.ru/vul/2019-01957",
"Impact": "Low",
"Public": "20190306"
},
{
"ID": "BDU:2019-01958",
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"CWE": "CWE-200, CWE-203, CWE-385",
"Href": "https://bdu.fstec.ru/vul/2019-01958",
"Impact": "Low",
"Public": "20190306"
},
{
"ID": "BDU:2019-01959",
"CVSS": "AV:L/AC:H/Au:S/C:C/I:N/A:N",
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"CWE": "CWE-200, CWE-203, CWE-385",
"Href": "https://bdu.fstec.ru/vul/2019-01959",
"Impact": "Low",
"Public": "20190306"
},
{
"ID": "BDU:2019-01960",
"CVSS": "AV:L/AC:H/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200, CWE-203, CWE-385",
"Href": "https://bdu.fstec.ru/vul/2019-01960",
"Impact": "Low",
"Public": "20190306"
},
{
"ID": "BDU:2019-02780",
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200, CWE-908",
"Href": "https://bdu.fstec.ru/vul/2019-02780",
"Impact": "Low",
"Public": "20190510"
},
{
"ID": "BDU:2020-02044",
"CVSS": "AV:A/AC:M/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"CWE": "CWE-122, CWE-787",
"Href": "https://bdu.fstec.ru/vul/2020-02044",
"Impact": "High",
"Public": "20190219"
}
],
"CVEs": [
{
"ID": "CVE-2018-12126",
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-12126",
"Impact": "Low",
"Public": "20190530"
},
{
"ID": "CVE-2018-12127",
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-12127",
"Impact": "Low",
"Public": "20190530"
},
{
"ID": "CVE-2018-12130",
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-12130",
"Impact": "Low",
"Public": "20190530"
},
{
"ID": "CVE-2019-11091",
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-11091",
"Impact": "Low",
"Public": "20190530"
},
{
"ID": "CVE-2019-11833",
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-908",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-11833",
"Impact": "Low",
"Public": "20190515"
},
{
"ID": "CVE-2019-9500",
"CVSS": "AV:A/AC:M/Au:N/C:C/I:C/A:C",
"CVSS3": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-9500",
"Impact": "High",
"Public": "20200116"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:8.4",
"cpe:/o:alt:spserver:8.4"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:3001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20192063001",
"Comment": "kernel-doc-std is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063002",
"Comment": "kernel-headers-modules-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063003",
"Comment": "kernel-headers-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063004",
"Comment": "kernel-image-domU-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063005",
"Comment": "kernel-image-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063006",
"Comment": "kernel-modules-drm-ancient-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063007",
"Comment": "kernel-modules-drm-nouveau-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063008",
"Comment": "kernel-modules-drm-radeon-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063009",
"Comment": "kernel-modules-drm-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063010",
"Comment": "kernel-modules-ide-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063011",
"Comment": "kernel-modules-kvm-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063012",
"Comment": "kernel-modules-staging-std-def is earlier than 1:4.19.49-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192063013",
"Comment": "kernel-modules-v4l-std-def is earlier than 1:4.19.49-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue View Git Blame Copy Permalink