1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 3313-1] linux security update

    From Salvatore Bonaccorso@1:229/2 to All on Thu Jul 23 09:00:02 2015
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-3313-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso
    July 23, 2015 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : linux
    CVE ID : CVE-2015-3290 CVE-2015-3291 CVE-2015-4167 CVE-2015-5157
    CVE-2015-5364 CVE-2015-5366

    Several vulnerabilities have been discovered in the Linux kernel that
    may lead to a privilege escalation or denial of service.

    CVE-2015-3290

    Andy Lutomirski discovered that the Linux kernel does not properly
    handle nested NMIs. A local, unprivileged user could use this flaw
    for privilege escalation.

    CVE-2015-3291

    Andy Lutomirski discovered that under certain conditions a malicious
    userspace program can cause the kernel to skip NMIs leading to a
    denial of service.

    CVE-2015-4167

    Carl Henrik Lunde discovered that the UDF implementation is missing
    a necessary length check. A local user that can mount devices could
    use this flaw to crash the system.

    CVE-2015-5157

    Petr Matousek and Andy Lutomirski discovered that an NMI that
    interrupts userspace and encounters an IRET fault is incorrectly
    handled. A local, unprivileged user could use this flaw for denial
    of service or possibly for privilege escalation.

    CVE-2015-5364

    It was discovered that the Linux kernel does not properly handle
    invalid UDP checksums. A remote attacker could exploit this flaw to
    cause a denial of service using a flood of UDP packets with invalid
    checksums.

    CVE-2015-5366

    It was discovered that the Linux kernel does not properly handle
    invalid UDP checksums. A remote attacker can cause a denial of
    service against applications that use epoll by injecting a single
    packet with an invalid checksum.

    For the stable distribution (jessie), these problems have been fixed in
    version 3.16.7-ckt11-1+deb8u2.

    For the unstable distribution (sid), these problems have been fixed in
    version 4.0.8-2 or earlier versions.

    We recommend that you upgrade your linux packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1

    iQIcBAEBCgAGBQJVsI3hAAoJEAVMuPMTQ89EqhcP/3/kR3DnbodC4GFblOYwidim LclDavSNCZGxJzLhlqDczTmEma/z0nr2UxSy1Y4E3QlIXzd+3KaYZBBH71Ktnk6L LJ79i3KKHtHogwvSUcjPNJD6++mbh5WS4uFKLepH9zO6ApF8BggThr7PFtl4r8Wn bPxUHYd0fhrfqksvvBSM3JDlDvZx2xTMl0/FG9Ka21zm5AjnU7TVa3VsQiU5Qirv hKTQSq5OyJ6URkfaOnB0ulmTWofCSy/A6QSN9meu8eHsB1qCkKw01DPBIs3LMaiv AzZZ3s/F9ovNI+BiQyWRvsJvqV6uYYHTrTsW/2LXdULsIR5nwohoi6OBHbtyA88L jOPgMMGZ0WwXTDGDgPjzWXInBhJh31j0hZr/yiW+owBhlqKrPoxgUoa3GDNgBvXS Pe/22MjxAne2XjIY0aWGJFokIDB10n4TJuLHYCtgqOUtAr2r5x/3p5nmU325QiqD f/9MMDwRS6AXabh6xFeW38b/NrYDuSm8wbYlFlzFh5plzNrb1pSSnW8QBAcapZuN u0XVrTSHpW0vabokKXs0KLlLhDGWIr0QnGCFt9DMEAISkyn13zLOYr65U8w+AXjB UFeDPcmZul83a4BlW86DxCBQmRPkGl1LeS/xRqYLMBS0OneE3xZx1Nv2FneVxwlr Cu+sM+Z7F1vlYKqRzhxw
    =4jts
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: https://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)