CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2014-4611
https://notcve.org/view.php?id=CVE-2014-4611
Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715. Desbordamiento de enteros en la implementación del algoritmo LZ4, utilizado en Yann Collet LZ4 anterior a r118 y en la función lz4_uncompress en lib/lz4/lz4_decompress.c en el kernel de Linux anterior a 3.15.2, en plataformas de 32-bits permite a atacantes dependientes del contexto provocar una denegación de servicio (corrupción de memoria) o posiblemente tener otro impacto no especificado a través de un 'Literal Run' manipulado que sería manejado inadecuadamente por programas que no obedecen una limitación en la API, una vulnerabilidad diferente a CVE-2014-4715 • http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html http://fastcompression.blogspot.fr/2014/06/debunking-lz4-20-years-old-bug-myth.html http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=206204a1162b995e2185275167b22468c00d6b36 http://lists.opensuse.org/opensuse-updates/2014-07/msg00025.html http://secunia.com/advisories/59567 http://secunia.com/advisories/59770 http://secunia.com/advisories/60238 http://twitter.com/djrbliss/statuses • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 5%CPEs: 8EXPL: 0CVE-2014-4667 – kernel: sctp: sk_ack_backlog wrap-around problem
https://notcve.org/view.php?id=CVE-2014-4667
The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. La función sctp_association_free en net/sctp/associola.cen en el kernel de Linux anterior a 3.15.2 no gestiona debidamente cierto valor de backlogs, lo que permite a atacantes remotos causar una denegación de servicio (interrupción del socket) mediante un paquete SCTP manipulado. An integer underflow flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation processed certain COOKIE_ECHO packets. By sending a specially crafted SCTP packet, a remote attacker could use this flaw to prevent legitimate connections to a particular SCTP server socket to be made. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d3217b15a19a4779c39b212358a5c71d725822ee http://linux.oracle.com/errata/ELSA-2014-3068.html http://linux.oracle.com/errata/ELSA-2014-3069.html http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://secunia.com/advisories/59777 http://secunia&# • CWE-190: Integer Overflow or Wraparound •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0206 – kernel: aio: insufficient sanitization of head in aio_read_events_ring()
https://notcve.org/view.php?id=CVE-2014-0206
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value. Error en el índice del array en la función aio_read_events_ring en fs/aio.c en el kernel de Linux hasta 3.15.1 permite a usuarios locales obtener información sensible de la memoria del kernel a través de un valor de cabecera grande. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=edfbbf388f293d70bf4b7c0bc38774d05e6f711a http://secunia.com/advisories/59278 http://www.securityfocus.com/bid/68176 http://www.securitytracker.com/id/1030479 http://www.securitytracker.com/id/1038201 https://bugzilla.redhat.com/show_bug.cgi?id=1094602 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edfbbf388f29 https://github.com/torvalds/linux/commit/edfbbf388f293d70bf4b7c0bc38774d05e6f711a http •
CVSS: 4.7EPSS: 0%CPEs: 2EXPL: 0CVE-2014-4171 – Kernel: mm/shmem: denial of service
https://notcve.org/view.php?id=CVE-2014-4171
mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call. mm/shmem.c en el kernel de Linux hasta 3.15.1 no implementa debidamente la interacción entre la notificación del rango y la creación de agujeros, lo que permite a usuarios locales causar una denegación de servicio (apropiación del i_mutex) mediante la llamada de sistema mmap para acceder a un agujero, tal y como fue demostrado mediante la interferencia con la actividad shmem intencionada a través del bloqueo del completado de (1) una llamada MADV_REMOVE madvise o (2) una llamada FALLOC_FL_PUNCH_HOLE fallocate. A race condition flaw was found in the way the Linux kernel's mmap(2), madvise(2), and fallocate(2) system calls interacted with each other while operating on virtual memory file system files. A local user could use this flaw to cause a denial of service. • http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html http://marc.info/?l=linux-mm-commits&m=140303745420549&w=2 http://ozlabs.org/~akpm/mmots/broken-out/shmem-fix-faulting-into-a-hole-while-its-punched.patch http://rhn.redhat.com/errata/RHSA-2014-1318.html http://rhn.redhat.com/errata/RHSA-2015-0102.html http://secunia.com/advisories/59777 http://secunia.com/advisories/60564 http& •
CVSS: 2.1EPSS: 0%CPEs: 7EXPL: 1CVE-2014-1739 – Linux Kernel 3.3.5 - '/drivers/media/media-device.c' Local Information Disclosure
https://notcve.org/view.php?id=CVE-2014-1739
The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call. La función media_device_enum_entities en drivers/media/media-device.c en el kernel de Linux anterior a 3.14.6 no inicializa cierta estructura de datos, lo que permite a usuarios locales obtener información sensible de la memoria del kernel mediante el aprovechamiento del acceso a lectura /dev/media0 para una llamada MEDIA_IOC_ENUM_ENTITIES ioctl. An information leak flaw was found in the way the Linux kernel handled media device enumerate entities IOCTL requests. A local user able to access the /dev/media0 device file could use this flaw to leak kernel memory bytes. • https://www.exploit-db.com/exploits/39214 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e6a623460e5fc960ac3ee9f946d3106233fd28d8 http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html http://secunia.com/advisories/59597 http://speirofr.appspot.com/cve-2014-1739-kernel-infoleak-vulnerability-in-media_enum_entities.html http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •