This update contains a kernel live patch for the 3.12.32-33 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044) - CVE-2015-1465: The IPv4 implementation in the Linux kernel did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets. (bsc#939044 bsc#916225)
#902349 #916225 #939044 #939240 #939241 #939260
#939262 #939263 #939270 #939273 #939276 #939277
Cross- CVE-2014-3687 CVE-2014-7822 CVE-2014-8159
CVE-2014-9710 CVE-2015-1465 CVE-2015-1805
CVE-2015-3331 CVE-2015-3339 CVE-2015-3636
CVE-2015-4700 CVE-2015-5364 CVE-2015-5366
Affected Products:
SUSE Linux Enterprise Live Patching 12
https://www.suse.com/security/cve/CVE-2014-3687.html
https://www.suse.com/security/cve/CVE-2014-7822.html
https://www.suse.com/security/cve/CVE-2014-8159.html
https://www.suse.com/security/cve/CVE-2014-9710.html
https://www.suse.com/security/cve/CVE-2015-1465.html
https://www.suse.com/security/cve/CVE-2015-1805.html
https://www.suse.com/security/cve/CVE-2015-3331.html
Get the latest Linux and open source security news straight to your inbox.