CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-0774 – kernel: pipe buffer state corruption after unsuccessful atomic read from pipe
https://notcve.org/view.php?id=CVE-2016-0774
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805. Las implementaciones (1) pipe_read y (2) pipe_write en fs/pipe.c en un determinado backport del kernel de Linux en el paquete linux en versiones anteriores a 3.2.73-2+deb7u3 sobre Debian wheezy y el paquete kernel en versiones anteriores a 3.10.0-229.26.2 sobre Red Hat Enterprise Linux (RHEL) 7.1 no considera correctamente los efectos laterales de llamadas __copy_to_user_inatomic y __copy_from_user_inatomic fallidas, lo que permite a usuarios locales provocar una denegación de servicio (caída de sistema) o posiblemente obtener prvilegios a través de una aplicación manipulada, también conocido como un "I/O vector array overrun". NOTA: esta vulnerabilidad existe debido a una solución incorrecta para CVE-2015-1805. It was found that the fix for CVE-2015-1805 incorrectly kept buffer offset and buffer length in sync on a failed atomic read, potentially resulting in a pipe buffer state corruption. • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2016-04 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 38EXPL: 5CVE-2016-0728 – Linux Kernel 4.4.1 - REFCOUNT Overflow Use-After-Free in Keyrings Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2016-0728
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands. La función join_session_keyring en security/keys/process_keys.c en el kernel de Linux en versiones anteriores a 4.4.1 no maneja correctamente referencias a objetos en un cierto caso de error, lo que permite a usuarios locales obtener privilegios o provocar una denegación de servicio (desbordamiento de entero y uso después de liberación) a través de comandos keyctl manipulados. A use-after-free flaw was found in the way the Linux kernel's key management subsystem handled keyring object reference counting in certain error path of the join_session_keyring() function. A local, unprivileged user could use this flaw to escalate their privileges on the system. • https://www.exploit-db.com/exploits/40003 https://www.exploit-db.com/exploits/39277 https://github.com/hal0taso/CVE-2016-0728 https://github.com/googleweb/CVE-2016-0728 https://github.com/th30d00r/Linux-Vulnerability-CVE-2016-0728-and-Exploit http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html http://lists.fedoraproject.org/pipermail/package-announce/2016 • CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 1CVE-2015-6637
https://notcve.org/view.php?id=CVE-2015-6637
The MediaTek misc-sd driver in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 25307013. El driver MediaTek misc-sd en Android en versiones anteriores a 5.1.1 LMY49F y 6.0 en versiones anteriores a 2016-01-01 permite a atacantes obtener privilegios a través de una aplicación manipulada, también conocida como error interno 25307013. • https://github.com/betalphafai/CVE-2015-6637 http://source.android.com/security/bulletin/2016-01-01.html http://www.securitytracker.com/id/1034592 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-6644 – bouncycastle: Information disclosure in GCMBlockCipher
https://notcve.org/view.php?id=CVE-2015-6644
Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146. Bouncy Castle en Android en versiones anteriores a 5.1.1 LMY49F y 6.0 en versiones anteriores a 2016-01-01 permite a atacantes obtener información sensible a través de una aplicación manipulada, también conocida como error interno 24106146. It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information. • http://source.android.com/security/bulletin/2016-01-01.html http://www.debian.org/security/2017/dsa-3829 http://www.securityfocus.com/bid/79865 http://www.securitytracker.com/id/1034592 https://access.redhat.com/errata/RHSA-2017:1832 https://access.redhat.com/errata/RHSA-2017:2808 https://access.redhat.com/errata/RHSA-2017:2809 https://access.redhat.com/errata/RHSA-2017:2810 https://access.redhat.com/errata/RHSA-2017:2811 https://access.redhat.com/errata/RHSA-2018:2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2015-6645
https://notcve.org/view.php?id=CVE-2015-6645
SyncManager in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to cause a denial of service (continuous rebooting) via a crafted application, aka internal bug 23591205. SyncManager en Android en versiones anteriores a 5.1.1 LMY49F y 6.0 en versiones anteriores a 2016-01-01 permite a atacantes causar una denegación de servicio (reinicio continuo) a través de una aplicación manipulada, también conocida como error interno 23591205. • http://source.android.com/security/bulletin/2016-01-01.html http://www.securitytracker.com/id/1034592 • CWE-264: Permissions, Privileges, and Access Controls •