rpm package
suse/kernel-ec2&distro=SUSE Linux Enterprise Module for Public Cloud 12
pkg:rpm/suse/kernel-ec2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2012
Vulnerabilities (409)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-3136 | Med | 4.6 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | May 2, 2016 | The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descripto | |
| CVE-2016-2188 | Med | 4.6 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | May 2, 2016 | The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-2186 | Med | 4.6 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | May 2, 2016 | The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-2185 | Med | 4.6 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | May 2, 2016 | The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-2117 | Hig | 7.5 | < 3.12.61-52.72.1 | 3.12.61-52.72.1 | May 2, 2016 | The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. | |
| CVE-2016-2053 | Med | 4.7 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | May 2, 2016 | The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/pub | |
| CVE-2015-1350 | Med | 5.5 | < 3.12.61-52.72.1 | 3.12.61-52.72.1 | May 2, 2016 | The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system | |
| CVE-2014-9717 | Med | 6.1 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | May 2, 2016 | fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 w | |
| CVE-2016-3672 | Hig | 7.8 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | Apr 27, 2016 | The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection | |
| CVE-2016-3156 | Med | 5.5 | < 3.12.57-60.35.1 | 3.12.57-60.35.1 | Apr 27, 2016 | The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses. | |
| CVE-2016-3139 | Med | 4.6 | < 3.12.57-60.35.1 | 3.12.57-60.35.1 | Apr 27, 2016 | The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. | |
| CVE-2016-3134 | Hig | 8.4 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | Apr 27, 2016 | The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. | |
| CVE-2016-2847 | Med | 6.2 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | Apr 27, 2016 | fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes. | |
| CVE-2016-2782 | Med | 4.6 | < 3.12.57-60.35.1 | 3.12.57-60.35.1 | Apr 27, 2016 | The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1 | |
| CVE-2016-2384 | Med | 4.6 | < 3.12.55-52.42.1 | 3.12.55-52.42.1 | Apr 27, 2016 | Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor. | |
| CVE-2016-2184 | Med | 4.6 | < 3.12.57-60.35.1 | 3.12.57-60.35.1 | Apr 27, 2016 | The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value i | |
| CVE-2016-2143 | Hig | 7.8 | < 3.12.57-60.35.1 | 3.12.57-60.35.1 | Apr 27, 2016 | The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/i | |
| CVE-2016-2069 | Hig | 7.4 | < 3.12.53-60.30.1 | 3.12.53-60.30.1 | Apr 27, 2016 | Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU. | |
| CVE-2016-0774 | Med | 6.8 | < 3.12.55-52.42.1 | 3.12.55-52.42.1 | Apr 27, 2016 | The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side | |
| CVE-2015-8845 | Med | 5.5 | < 3.12.60-52.49.1 | 3.12.60-52.49.1 | Apr 27, 2016 | The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exceptio |
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descripto
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.12.61-52.72.1fixed 3.12.61-52.72.1
The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/pub
- affected < 3.12.61-52.72.1fixed 3.12.61-52.72.1
The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 w
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection
- affected < 3.12.57-60.35.1fixed 3.12.57-60.35.1
The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses.
- affected < 3.12.57-60.35.1fixed 3.12.57-60.35.1
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.
- affected < 3.12.57-60.35.1fixed 3.12.57-60.35.1
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1
- affected < 3.12.55-52.42.1fixed 3.12.55-52.42.1
Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
- affected < 3.12.57-60.35.1fixed 3.12.57-60.35.1
The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value i
- affected < 3.12.57-60.35.1fixed 3.12.57-60.35.1
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/i
- affected < 3.12.53-60.30.1fixed 3.12.53-60.30.1
Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU.
- affected < 3.12.55-52.42.1fixed 3.12.55-52.42.1
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side
- affected < 3.12.60-52.49.1fixed 3.12.60-52.49.1
The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exceptio
Page 17 of 21