rpm package
suse/kernel-bigsmp&distro=SUSE Manager Proxy 2.1
pkg:rpm/suse/kernel-bigsmp&distro=SUSE%20Manager%20Proxy%202.1
Vulnerabilities (95)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-4578 | Med | 5.5 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 23, 2016 | sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) sn | |
| CVE-2016-4569 | Med | 5.5 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 23, 2016 | The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface. | |
| CVE-2016-4565 | Hig | 7.8 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 23, 2016 | The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. | |
| CVE-2016-4486 | Low | 3.3 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 23, 2016 | The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message. | |
| CVE-2016-4485 | Hig | 7.5 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 23, 2016 | The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message. | |
| CVE-2016-4482 | Med | 6.2 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 23, 2016 | The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. | |
| CVE-2016-3140 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | May 2, 2016 | The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-3138 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | May 2, 2016 | The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor. | |
| CVE-2016-3137 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | May 2, 2016 | drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the c | |
| CVE-2016-2188 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | May 2, 2016 | The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-2187 | Med | 4.6 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 2, 2016 | The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-2186 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | May 2, 2016 | The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-2185 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | May 2, 2016 | The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-2053 | Med | 4.7 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | May 2, 2016 | The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/pub | |
| CVE-2015-1350 | Med | 5.5 | < 3.0.101-0.47.96.1 | 3.0.101-0.47.96.1 | May 2, 2016 | The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system | |
| CVE-2016-3156 | Med | 5.5 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | Apr 27, 2016 | The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses. | |
| CVE-2016-3139 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | Apr 27, 2016 | The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-3134 | Hig | 8.4 | < 3.0.101-0.47.86.1 | 3.0.101-0.47.86.1 | Apr 27, 2016 | The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. | |
| CVE-2016-2847 | Med | 6.2 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | Apr 27, 2016 | fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes. | |
| CVE-2016-2782 | Med | 4.6 | < 3.0.101-0.47.79.1 | 3.0.101-0.47.79.1 | Apr 27, 2016 | The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1 |
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) sn
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the c
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/pub
- affected < 3.0.101-0.47.96.1fixed 3.0.101-0.47.96.1
The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.0.101-0.47.86.1fixed 3.0.101-0.47.86.1
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.
- affected < 3.0.101-0.47.79.1fixed 3.0.101-0.47.79.1
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1
Page 3 of 5