Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Debian: DLA-993-2 Moderate: Java Application Fixes for Privilege Escalation

debian lts
Calendar Grey June 27, 2017
Scroller Debian Lts
Revised Linux software versions can now be obtained to address program issues that arose from the last security patch.
The security update announced as DLA-993-1 caused regressions for some applications using Java - including jsvc, LibreOffice and Scilab - due to the fix for CVE-2017-1000364
Topics%20covered

Topics Covered

security advisory debian privilege escalation application issue linux fix

Summary

The Qualys Research Labs discovered that the size of the stack guard
page is not sufficiently large. The stack-pointer can jump over the
guard-page and moving from the stack into another memory region
without accessing the guard-page. In this case no page-fault
exception is raised and the stack extends into the other memory
region. An attacker can exploit this flaw for privilege escalation.

The default stack gap protection is set to 256 pages and can be
configured via the stack_guard_gap kernel parameter on the kernel
command line.

Further details can be found at
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

For Debian 7 "Wheezy", this problem has been fixed in version
3.2.89-2.

For Debian 8 "Jessie", this problem has been fixed in version
3.16.43-2+deb8u2.

For Debian 9 "Stretch", this problem has been fixed in version
4.9.30-2+deb9u2.

We recommend that you upgrade your linux packages.

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

<pre><font face="Courier">Package: linux
Version: 3.2.89-2
Debian Bug: 865303

Topics%20covered

Topics Covered

security advisory debian privilege escalation application issue linux fix

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.