The openSUSE 13.1 kernel was updated to 3.12.57 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov. (bsc#963765)

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call. (bsc#961500)

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

The following non-security bugs were fixed :

  - acl: Fix problem with setting ACL on directories     (bsc#867251).

  - acpi / processor: Introduce apic_id in struct processor     to save parsed APIC id (bsc#959463).

  - alsa: rawmidi: Make snd_rawmidi_transmit() race-free     (bsc#968018).

  - alsa: seq: Fix leak of pool buffer at concurrent writes     (bsc#968018).

  - arm: cubox: Add separate cubox configuration.

  - arm: xen: implement multicall hypercall support.

  - block: xen-blkfront: Fix possible NULL ptr dereference     (bsc#957986 fate#320625).

  -     btrfs-8394-qgroup-Account-data-space-in-more-proper-timi     n.patch: (bsc#963193).

  - btrfs: Add handler for invalidate page (bsc#963193).

  - btrfs: check prepare_uptodate_page() error code earlier     (bnc#966910).

  - btrfs: delayed_ref: Add new function to record reserved     space into delayed ref (bsc#963193).

  - btrfs: delayed_ref: release and free qgroup reserved at     proper timing (bsc#963193).

  - btrfs: extent_io: Introduce needed structure for     recoding set/clear bits (bsc#963193).

  - btrfs: extent_io: Introduce new function     clear_record_extent_bits() (bsc#963193).

  - btrfs: extent_io: Introduce new function     set_record_extent_bits (bsc#963193).

  - btrfs: extent-tree: Add new version of     btrfs_check_data_free_space and     btrfs_free_reserved_data_space (bsc#963193).

  - btrfs: extent-tree: Add new version of     btrfs_delalloc_reserve/release_space (bsc#963193).

  - btrfs: extent-tree: Switch to new check_data_free_space     and free_reserved_data_space (bsc#963193).

  - btrfs: extent-tree: Switch to new delalloc space reserve     and release (bsc#963193).

  - btrfs: fallocate: Add support to accurate qgroup reserve     (bsc#963193).

  - btrfs: fix invalid page accesses in extent_same (dedup)     ioctl (bnc#968230).

  - btrfs: fix page reading in extent_same ioctl leading to     csum errors (bnc#968230).

  - btrfs: fix warning in backref walking (bnc#966278).

  - btrfs: qgroup: Add handler for NOCOW and inline     (bsc#963193).

  - btrfs: qgroup: Add new trace point for qgroup data     reserve (bsc#963193).

  - btrfs: qgroup: Avoid calling     btrfs_free_reserved_data_space in clear_bit_hook     (bsc#963193).

  - btrfs: qgroup: Check if qgroup reserved space leaked     (bsc#963193).

  - btrfs: qgroup: Cleanup old inaccurate facilities     (bsc#963193).

  - btrfs: qgroup: Fix a race in delayed_ref which leads to     abort trans (bsc#963193).

  - btrfs: qgroup: Fix a rebase bug which will cause qgroup     double free (bsc#963193).

  - btrfs: qgroup: Fix dead judgement on     qgroup_rescan_leaf() return value (bsc#969439).

  - btrfs: qgroup: Introduce btrfs_qgroup_reserve_data     function (bsc#963193).

  - btrfs: qgroup: Introduce functions to release/free     qgroup reserve data space (bsc#963193).

  - btrfs: qgroup: Introduce new functions to reserve/free     metadata (bsc#963193).

  - btrfs: qgroup: Use new metadata reservation     (bsc#963193).

  - cpu: Provide smpboot_thread_init() on !CONFIG_SMP     kernels as well.

  - dcache: use IS_ROOT to decide where dentry is hashed     (bsc#949752).

  - dmapi: fix dm_open_by_handle_rvp taking an extra ref to     mnt (bsc#967292).

  - drivers/base/memory.c: fix kernel warning during memory     hotplug on ppc64 (bsc#963827).

  - drivers:hv: Allow for MMIO claims that span ACPI _CRS     records (bnc#965924).

  - drivers:hv: Define the channel type for Hyper-V PCI     Express pass-through (bnc#965924).

  - drivers:hv: Export a function that maps Linux CPU num     onto Hyper-V proc num (bnc#965924).

  - drivers:hv: Export the API to invoke a hypercall on     Hyper-V (bnc#965924).

  - drivers: hv: kvp: fix IP Failover.

  - drivers:pci:hv: New paravirtual PCI front-end for     Hyper-V VMs (bnc#965924).

  - drivers: xen-blkfront: only talk_to_blkback() when in     XenbusStateInitialising (bsc#957986 fate#320625).

  - driver: xen-blkfront: move talk_to_blkback to a more     suitable place (bsc#957986 fate#320625).

  - drm/i915: do not warn if backlight unexpectedly enabled     (boo#972068).

  - drm/i915: set backlight duty cycle after backlight     enable for gen4 (boo#972780).

  - e1000e: Avoid divide by zero error (bsc#968643).

  - e1000e: fix division by zero on jumbo MTUs (bsc#968643).

  - e1000e: Fix tight loop implementation of systime read     algorithm (bsc#968643).

  - fix: print ext4 mountopt data_err=abort correctly     (bsc#969735).

  - fs/proc_namespace.c: simplify testing nsp and     nsp->mnt_ns (bug#963960).

  - futex: Drop refcount if requeue_pi() acquired the     rtmutex (bug#960174).

  - hv: Lock access to hyperv_mmio resource tree     (bnc#965924).

  - hv: Make a function to free mmio regions through vmbus     (bnc#965924).

  - hv: Reverse order of resources in hyperv_mmio     (bnc#965924).

  - hv: Track allocations of children of hv_vmbus in private     resource tree (bnc#965924).

  - hv: Use new vmbus_mmio_free() from client drivers     (bnc#965924).

  - hwmon: (coretemp) Increase maximum core to 128     (bsc#970160)

  - ibmvnic: Fix ibmvnic_capability struct (fate#320253).

  - intel_pstate: Use del_timer_sync in     intel_pstate_cpu_stop (bsc#967650).

  - ipv6: mld: fix add_grhead skb_over_panic for devs with     large MTUs (bsc#956852).

  - kabi: Preserve checksum of kvm_x86_ops (bsc#969112).

  - kABI: protect enum enclosure_component_type.

  - kabi: protect struct acpi_processor signature     (bsc#959463).

  - kABI: protect struct af_alg_type.

  - kABI: protect struct crypto_ahash.

  - kABI: protect struct dm_exception_store_type.

  - kABI: protect struct fib_nh_exception.

  - kABI: protect struct module.

  - kABI: protect struct rq.

  - kABI: protect struct sched_class.

  - kABI: protect struct scm_creds.

  - kABI: protect struct user_struct.

  - kabi/severities :

  - kabi/severities: Fail on changes in kvm_x86_ops, needed     by lttng-modules

  - kgr: fix reversion of a patch already reverted by a     replace_all patch (fate#313296).

  - kvm: SVM: add rdmsr support for AMD event registers     (bsc#968448).

  - kvm: x86: Check dest_map->vector to match eoi signals     for rtc (bsc#966471).

  - kvm: x86: Convert ioapic->rtc_status.dest_map to a     struct (bsc#966471).

  - kvm: x86: store IOAPIC-handled vectors in each VCPU     (bsc#966471).

  - kvm: x86: Track irq vectors in     ioapic->rtc_status.dest_map (bsc#966471).

  - libceph: fix scatterlist last_piece calculation     (bsc#963746).

  - lpfc: Fix kmalloc overflow in LPFC driver at large core     count (bsc#969690).

  - memcg: do not hang on OOM when killed by userspace OOM     access to memory reserves (bnc#969571).

  - mld, igmp: Fix reserved tailroom calculation     (bsc#956852).

  - mmc: Exynos: Add module alias for dw mmc.

  - mvneta: fix per-cpu stats initialization.

  - namespaces: Re-introduce task_nsproxy() helper     (bug#963960).

  - namespaces: Use task_lock and not rcu to protect nsproxy     (bug#963960).

  - net: core: Correct an over-stringent device loop     detection (bsc#945219).

  - net: irda: Fix use-after-free in irtty_open()     (bnc#967903).

  - nfs4: treat lock owners as opaque values (bnc#968141).

  - nfs: Background flush should not be low priority     (bsc#955308).

  - nfsd: fix nfsd_setattr return code for HSM (bsc#969992).

  - nfs: do not use STABLE writes during writeback     (bnc#816099).

  - nfs: Fix handling of re-write-before-commit for mmapped     NFS pages (bsc#964201).

  - nvme: default to 4k device page size (bsc#967047).

  - nvme: special case AEN requests (bsc#965087).

  - omap3isp: fix miscompile.

  - omap: Fix missing cm3xxx.h include.

  - omap: Fix missing usb.h include.

  - pci: Add global pci_lock_rescan_remove() (bnc#965924).

  - pci: allow access to VPD attributes with size 0     (bsc#959146).

  - pciback: Check PF instead of VF for PCI_COMMAND_MEMORY.

  - pciback: Save the number of MSI-X entries to be copied     later.

  - pci: Blacklist vpd access for buggy devices     (bsc#959146).

  - pci: Determine actual VPD size on first access     (bsc#959146).

  - pci: Export symbols required for loadable host driver     modules (bnc#965924).

  - pci: pciehp: Disable link notification across slot reset     (bsc#967651).

  - pci: pciehp: Do not check adapter or latch status while     disabling (bsc#967651).

  - pci: pciehp: Do not disable the link permanently during     removal (bsc#967651).

  - pci: pciehp: Ensure very fast hotplug events are also     processed (bsc#967651).

  - pci: Update VPD definitions (bsc#959146).

  - perf, nmi: Fix unknown NMI warning (bsc#968512).

  - power: Add _GLOBAL_TOC for 32bit.

  - proc: Fix ptrace-based permission checks for accessing     task maps.

  - qla2xxx: Remove unavailable firmware files (bsc#943645).

  - rbd: do not log miscompare as an error (bsc#970062).

  - Refresh     patches.drivers/0005-aacraid-MSI-x-support.patch.
    (boo#970249)

  - resources: Set type in __request_region() (bnc#965924).

  - Revert 'ipv6: tcp: add rcu locking in     tcp_v6_send_synack()' (bnc#961257).

  - rpm/kernel-binary.spec.in: Sync the main and -base     package dependencies (bsc#965830#c51).

  - rpm/kernel-module-subpackage: Fix obsoleting dropped     flavors (bsc#968253)

  - sched: unbreak non-SMP build.

  - scsi_dh_alua: Do not block request queue if workqueue is     active (bsc#960458).

  - scsi: fix soft lockup in scsi_remove_target() on module     removal (bsc#965199).

  - scsi: proper state checking and module refcount handling     in scsi_device_get (boo#966831).

  - series.conf: add section comments

  - supported.conf: Add e1000e (emulated by VMware) to -base     (bsc#968074)

  - supported.conf: Add Hyper-V modules to -base     (bsc#965830)

  - supported.conf: Add isofs to -base (bsc#969655).

  - supported.conf: Add more qemu device driver (bsc#968234)

  - supported.conf: Add mptspi and mptsas to -base     (bsc#968206)

  - supported.conf: Add the qemu scsi driver (sym53c8xx) to
    -base (bsc#967802)

  - supported.conf: Add tulip to -base for Hyper-V     (bsc#968234)

  - supported.conf: Add virtio-rng (bsc#966026)

  - supported.conf: Add xen-blkfront.

  - supported.conf: Add xfs to -base (bsc#965891)

  - supported.conf: Fix usb-common path usb-common moved to     its own subdirectory in kernel v3.16, and we backported     that change to SLE12.

  - sysctl: do not add hardlockup_all_cpu_backtrace sysctl     on UP.

  - tcp: Restore RFC5961-compliant behavior for SYN packets     (bsc#966864).

  - Update config files. Add new option     CONFIG_PARAVIRT_XEN_BLKDEV_FRONTEND to i386 xen and ec2.

  - Update config files. Enable CONFIG_DEBUG_INFO for ec2     flavor. It's overriden on build anyway and having it     disabled causes 'make silentoldconfig' checks fail     because of new symbol CONFIG_DEBUG_INFO_REDUCED.

  - Update config files: enable CONFIG_PCI_HYPERV in non-SLE     configs These are i386/* except xen, ec2 and vanilla and     x86_64 desktop and trace.

  - Update config files: enable MACH_CUBOX in armv7hl/cubox

  - Update config files: ppc and ppc64 are big endian New     config options (not existing in 13.1) need to be set     accordingly.

  - Update     patches.drivers/drm-ast-Initialize-data-needed-to-map-fb     dev-memory.patch (bnc#880007). Fix refs and upstream     status.

  - Update Xen config files (enable upstream block     frontend).

  - Update Xen patches to 3.12.55.

  - USB: ehci-s5p: Fix phy reset.

  - usb: phy: Fix phy-samsung-usb when built as module.

  - usb: Quiet down false peer failure messages     (bnc#960629).

  - x86: export x86_msi (bnc#965924).

  - xen: Add /etc/modprobe.d/50-xen.conf selecting Xen     frontend driver implementation (bsc#957986, bsc#956084,     bsc#961658).

  - xen-blkfront: allow building in our Xen environment     (bsc#957986 fate#320625).

  - xen, blkfront: factor out flush-related checks from     do_blkif_request() (bsc#957986 fate#320625).

  - xen-blkfront: fix accounting of reqs when migrating     (bsc#957986 fate#320625).

  - xen/blkfront: Fix crash if backend does not follow the     right states (bsc#957986 fate#320625).

  - xen-blkfront: improve aproximation of required grants     per request (bsc#957986 fate#320625).

  - xen/blkfront: improve protection against issuing     unsupported REQ_FUA (bsc#957986 fate#320625).

  - xen/blkfront: remove redundant flush_op (bsc#957986     fate#320625).

  - xen-blkfront: remove type check from     blkfront_setup_discard (bsc#957986 fate#320625).

  - xen-blkfront: Silence pfn maybe-uninitialized warning     (bsc#957986 fate#320625).

  - xen: fix blkfront and blkback build with normal xen.

  - xen-vscsi-large-requests: Fix resource collision for     racing request maps and unmaps (bsc#966094).

  - xfs/dmapi: drop lock over synchronous XFS_SEND_DATA     events (bsc#969993).

  - xfs/dmapi: propertly send postcreate event (bsc#967299).

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (system crash) via a crafted no-journal     filesystem, a related issue to CVE-2013-2015     (bnc#956707).

  - CVE-2015-7515: An out of bounds memory access in the     aiptek USB driver could be used by physical local     attackers to crash the kernel (bnc#956708).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7566: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#961512).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988). (bsc#957988 XSA-155).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     do not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

  - CVE-2016-2143: On zSeries a fork of a large process     could have caused memory corruption due to incorrect     page table handling. (bnc#970504, LTC#138810).

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2185: A malicious USB device could cause kernel     crashes in the usb_driver_claim_interface function     (bnc#971124).

  - CVE-2016-2186: A malicious USB device could cause kernel     crashes in the powermate device driver (bnc#970958).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2543: A missing NULL check at remove_events     ioctl in the ALSA seq driver was fixed. (bsc#967972).

  - CVE-2016-2544: Fix race at timer setup and close in the     ALSA seq driver was fixed. (bsc#967973).

  - CVE-2016-2545: A double unlink of active_list in the     ALSA timer driver was fixed. (bsc#967974).

  - CVE-2016-2546: A race among ALSA timer ioctls was fixed     (bsc#967975).

  - CVE-2016-2547,CVE-2016-2548: The ALSA slave timer list     handling was hardened against hangs and races.
    (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012).

  - CVE-2016-2549: A stall in ALSA hrtimer handling was     fixed (bsc#968013).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3137: A malicious USB device could cause kernel     crashes in the cypress_m8 device driver (bnc#970970).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3140: A malicious USB device could cause kernel     crashes in the digi_acceleport device driver     (bnc#970892).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

  - CVE-2016-3955: A remote buffer overflow in the usbip     driver could be used by authenticated attackers to crash     the kernel. (bsc#975945)

  - CVE-2016-2847: A local user could exhaust kernel memory     by pushing lots of data into pipes. (bsc#970948).

  - CVE-2016-2188: A malicious USB device could cause kernel     crashes in the iowarrior device driver (bnc#970956).

  - CVE-2016-3138: A malicious USB device could cause kernel     crashes in the cdc-acm device driver (bnc#970911).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest upstream stable release, Linux v4.3.4. Fixes for Elan touchpads.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2929-1 advisory.

    Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when     handling IPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-3134)

    It was discovered that the Linux kernel did not properly enforce rlimits for file descriptors sent over     UNIX domain sockets. A local attacker could use this to cause a denial of service. (CVE-2013-4312)

    Ralf Spenneberg discovered that the USB driver for Clie devices in the Linux kernel did not properly     validate the endpoints reported by the device. An attacker with physical access could cause a denial of     service (system crash). (CVE-2015-7566)

    Ralf Spenneberg discovered that the usbvision driver in the Linux kernel did not properly validate the     interfaces and endpoints reported by the device. An attacker with physical access could cause a denial of     service (system crash). (CVE-2015-7833)

    It was discovered that a race condition existed in the ioctl handler for the TTY driver in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or expose sensitive     information. (CVE-2016-0723)

    Andrey Konovalov discovered that the ALSA USB MIDI driver incorrectly performed a double-free. A local     attacker with physical access could use this to cause a denial of service (system crash) or possibly     execute arbitrary code with administrative privileges. (CVE-2016-2384)

    Dmitry Vyukov discovered that the Advanced Linux Sound Architecture (ALSA) framework did not verify that a     FIFO was attached to a client before attempting to clear it. A local attacker could use this to cause a     denial of service (system crash). (CVE-2016-2543)

    Dmitry Vyukov discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA)     framework between timer setup and closing of the client, resulting in a use-after-free. A local attacker     could use this to cause a denial of service. (CVE-2016-2544)

    Dmitry Vyukov discovered a race condition in the timer handling implementation of the Advanced Linux Sound     Architecture (ALSA) framework, resulting in a use-after-free. A local attacker could use this to cause a     denial of service (system crash). (CVE-2016-2545)

    Dmitry Vyukov discovered race conditions in the Advanced Linux Sound Architecture (ALSA) framework's timer     ioctls leading to a use-after-free. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-2546)

    Dmitry Vyukov discovered that the Advanced Linux Sound Architecture (ALSA) framework's handling of high     resolution timers did not properly manage its data structures. A local attacker could use this to cause a     denial of service (system hang or crash) or possibly execute arbitrary code. (CVE-2016-2547,     CVE-2016-2548)

    Dmitry Vyukov discovered that the Advanced Linux Sound Architecture (ALSA) framework's handling of high     resolution timers could lead to a deadlock condition. A local attacker could use this to cause a denial of     service (system hang). (CVE-2016-2549)

    Ralf Spenneberg discovered that the USB driver for Treo devices in the Linux kernel did not properly     validate the endpoints reported by the device. An attacker with physical access could cause a denial of     service (system crash). (CVE-2016-2782)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when handling IPT_SO_SET_REPLACE events.
A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-3134)

Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-3135)

Ralf Spenneberg discovered that the USB driver for Clie devices in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). (CVE-2015-7566)

It was discovered that a race condition existed when handling heartbeat- timeout events in the SCTP implementation of the Linux kernel. A remote attacker could use this to cause a denial of service.
(CVE-2015-8767)

It was discovered that a race condition existed in the ioctl handler for the TTY driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2016-0723)

Andrey Konovalov discovered that the ALSA USB MIDI driver incorrectly performed a double-free. A local attacker with physical access could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-2384)

Ralf Spenneberg discovered that the USB driver for Treo devices in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). (CVE-2016-2782).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
90783	openSUSE Security Update : the Linux Kernel (openSUSE-2016-518)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
90884	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:1203-1)	Nessus	SuSE Local Security Checks	2016/5/4	2021/1/19	critical
89507	Fedora 23 : kernel-4.3.4-300.fc23 (2016-2f25d12c51)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	critical
89932	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2929-1)	Nessus	Ubuntu Local Security Checks	2016/3/15	2024/8/27	high
89995	Ubuntu 15.10 : linux-raspi2 vulnerabilities (USN-2930-3)	Nessus	Ubuntu Local Security Checks	2016/3/17	2023/1/17	high

检测

插件搜索

critical

critical

critical

high

high