CVSS: 7.8EPSS: 2%CPEs: 12EXPL: 0CVE-2017-7645 – kernel: nfsd: Incorrect handling of long RPC replies
https://notcve.org/view.php?id=CVE-2017-7645
18 Apr 2017 — The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. El servidor NFSv2/NFSv3 en el subsistema nfsd en el Kernel de Linux hasta la versión 4.10.11 permite a atacantes remotos provocar una denegación de servicio (caída de sistema) a través de una respuesta RPC larga, relacionada con net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c y fs/n... • http://www.debian.org/security/2017/dsa-3886 • CWE-20: Improper Input Validation CWE-130: Improper Handling of Length Parameter Inconsistency •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2017-7889 – kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism
https://notcve.org/view.php?id=CVE-2017-7889
17 Apr 2017 — The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c. El subsistema mm en el kernel de Linux hasta la versión 3.2 no aplica adecuadamente el mecanismo de protección CONFIG_STRICT_DEVMEM, lo que permite... • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a4866aa812518ed1a37d8ea0c881dc946409de94 • CWE-391: Unchecked Error Condition CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.6EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5856
https://notcve.org/view.php?id=CVE-2016-5856
12 Apr 2017 — Drivers/soc/qcom/spcom.c in the Qualcomm SPCom driver in the Android kernel 2017-03-05 allows local users to gain privileges, a different vulnerability than CVE-2016-5857. Drivers/soc/qcom/spcom.c en el driver Qualcom SPCom en el kernel de Android 2017-03-05 permite a usuarios locales obtener privilegios, una vulnerabilidad diferente a CVE-2016-5857. • http://www.securitytracker.com/id/1037968 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-7618 – Ubuntu Security Notice USN-3312-2
https://notcve.org/view.php?id=CVE-2017-7618
10 Apr 2017 — crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue. crypto/ahash.c en el kernel de Linux hasta 4.10.9 permite a los atacantes causar una denegación de servicio (operación de API llamando a su propia devolución de llamada, y recursión infinita) activando EBUSY en una cola completa. USN-3358-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update p... • http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7616 – kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c
https://notcve.org/view.php?id=CVE-2017-7616
10 Apr 2017 — Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. El manejo incorrecto de los errores en las syscalls set_mempolicy y mbind compat en mm/mempolicy.c en el kernel de Linux hasta la versión 4.10.9 permite a los usuarios locales obtener información confidencial de datos de pila no inicializados al activar... • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cf01fb9985e8deb25ccf0ea54d916b8871ae0e62 • CWE-388: 7PK - Errors CWE-390: Detection of Error Condition Without Action •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 3CVE-2017-2671 – Linux Kernel - 'ping' Local Denial of Service
https://notcve.org/view.php?id=CVE-2017-2671
05 Apr 2017 — The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call. En LightDM en versiones hasta 1.22.0, un problema de directorio transversal en debian/guest-account.sh permite a atacantes locales allows local attackers poseer ubicaciones de... • https://packetstorm.news/files/id/142872 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10318
https://notcve.org/view.php?id=CVE-2016-10318
04 Apr 2017 — A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service. Una comprobación de autorización que falta en la función fscrypt_process_policy en fs/crypto/policy.c en el soporte de cifrado del sistema de archivos ext4 y f2fs en el kernel de Linux en versiones anteriores... • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=163ae1c6ad6299b19e22b4a35d5ab24a89791a98 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 10EXPL: 0CVE-2016-10229
https://notcve.org/view.php?id=CVE-2016-10229
04 Apr 2017 — udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag. Udp.c en el kernel de Linux en versiones anteriores a 4.5 permite a los atacantes remotos ejecutar código arbitrario a través del tráfico UDP que dispara un segundo cálculo de checksum inseguro durante la ejecución de una llamada al sistema recv con el indicador MSG_PEEK. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16537 – Ubuntu Security Notice USN-3617-3
https://notcve.org/view.php?id=CVE-2017-16537
03 Apr 2017 — The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. La función imon_probe en drivers/media/rc/imon.c en el kernel de Linux, en versiones hasta la 4.13.11, permite que los usuarios locales provoquen una denegación de servicio (desreferencia de puntero NULL y cierre inesperado del sistema) o, posiblemente, causen otro... • https://groups.google.com/d/msg/syzkaller/bBFN8imrjjo/-5jCl8EiCQAJ • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 22EXPL: 0CVE-2017-17806 – kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service
https://notcve.org/view.php?id=CVE-2017-17806
03 Apr 2017 — The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. La implementación HMAC (crypto/hmac.c) en el kernel de Linux en versiones ... • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 • CWE-391: Unchecked Error Condition CWE-787: Out-of-bounds Write •