CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5243
https://notcve.org/view.php?id=CVE-2016-5243
The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message. La función tipc_nl_compat_link_dump en net/tipc/netlink_compat.c en el kernel de Linux hasta la versión 4.6.3 no copia adecuadamente una cierta cadena, lo que permite a usuarios locales obtener información sensible de la memoria de pila del kernel leyendo un mensaje Netlink. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5d2be1422e02ccd697ccfcd45c85b4a26e6178e2 http://www.debian.org/security/2016/dsa-3607 http://www.openwall.com/lists/oss-security/2016/06/03/4 http://www.securityfocus.com/bid/91334 http://www.ubuntu.com/usn/USN-3049-1 http://www.ubuntu.com/usn/USN-3050-1 http://www.ubuntu.com/usn/USN-3051-1 http://www.ubuntu.com/usn/USN-3052-1 http://www.ubuntu.com/usn/USN-3053-1 http:// • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2014-9904
https://notcve.org/view.php?id=CVE-2014-9904
The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call. La función snd_compress_check_input en sound/core/compress_offload.c en el subsistema ALSA en el kernel de Linux en versiones anteriores a 3.17 no comprueba correctamente un desbordamiento de enteros, lo que permite a usuarios locales provocar una denegación de servicio (insuficiente asignación de memoría) o posiblemente tener otros impactos no especificados a través de una llamada SNDRV_COMPRESS_SET_PARAMS ioctl manipulada. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6217e5ede23285ddfee10d2e4ba0cc2d4c046205 http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html http://www.debian.org/security/2016/dsa-3616 http://www.securityfocus.com/bid/91510 http://www.securitytracker.com/id/1036189 https://github.com/torvalds/linux/c •
CVSS: 7.8EPSS: 0%CPEs: 17EXPL: 0CVE-2016-4470 – kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path
https://notcve.org/view.php?id=CVE-2016-4470
The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command. La función key_reject_and_link en security/keys/key.c en el kernel de Linux hasta la versión 4.6.3 no asegura que cierta estructura de datos esté inicializada, lo que permite a usuarios locales provocar una denegación de servicio (caída del sistema) a través de vectores involucrando un comando keyctl request2 manipulado. A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38327424b40bcebe2de92d07312c89360ac9229a http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.html http://lists.opensuse.org • CWE-253: Incorrect Check of Function Return Value •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2066
https://notcve.org/view.php?id=CVE-2016-2066
Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application that makes an ioctl call. Error de entero sin signo en el controlador de audio MSM QDSP6 para el kernel de Linux 3.x, según se utiliza en contribuciones Android Qualcomm Innovation Center (QuIC) para dispositivos MSM y otros productos, permite a atacantes obtener privilegios o provocar una denegación de servicio (corrupción de memoria) a través de una aplicación manipulada que hace una llamada ioctl. • http://source.android.com/security/bulletin/2016-06-01.html http://www.securityfocus.com/bid/91046 https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88 https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2064-cve • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2061
https://notcve.org/view.php?id=CVE-2016-2061
Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (array overflow and memory corruption) via a crafted application that triggers an msm_isp_axi_create_stream call. Error de entero sin signo en el controlador de video MSM V4L2 para el kernel de Linux 3.x, según se utiliza en contribuciones Android Qualcomm Innovation Center (QuIC) para dispositivos MSM y otros productos, permite a atacantes obtener privilegios o provocar una denegación de servicio (desbordamiento de array y corrupción de memoria) a través de una aplicación manipulada que desencadena una llamada msm_isp_axi_create_stream. • http://source.android.com/security/bulletin/2016-06-01.html https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.18/commit/id=79db14ca9f791a14be9376a0340ad3b9b9a4d603 https://www.codeaurora.org/array-overflow-msm-v4l2-video-driver-allows-kernel-memory-corruption-cve-2016-2061 • CWE-269: Improper Privilege Management •