Alerts This Week
Warning Icon 1 684
Alerts This Week
Warning Icon 1 684

SUSE: 2016:3109-1 Important: Kernel Patch for Denial of Service

suse
Calendar Grey December 13, 2016
Dist Suse Esm H88
SUSE has released a significant security update targeting critical kernel vulnerabilities found in Live Patch 13 for SLE 12. Remain vigilant.
An update that fixes three vulnerabilities is now available

Summary

This update for the Linux Kernel 3.12.55-52_45 fixes several issues. The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012759). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bsc#1012183). - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that

References

#1003253 #1012183 #1012759

Cross- CVE-2016-7117 CVE-2016-8655 CVE-2016-9555

Affected Products:

SUSE Linux Enterprise Server for SAP 12

SUSE Linux Enterprise Server 12-LTSS

https://www.suse.com/security/cve/CVE-2016-7117.html

https://www.suse.com/security/cve/CVE-2016-8655.html

https://www.suse.com/security/cve/CVE-2016-9555.html

https://bugzilla.suse.com/1003253

https://bugzilla.suse.com/1012183

https://bugzilla.suse.com/1012759

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2016:3109-1
Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here