Lucene search

K
debianDebianDEBIAN:DLA-378-1:26763
HistoryJan 05, 2016 - 6:07 p.m.

[SECURITY] [DLA 378-1] linux-2.6 security update

2016-01-0518:07:03
lists.debian.org
29

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

44.2%

Package        : linux-2.6
Version        : 2.6.32-48squeeze18
CVE ID         : CVE-2015-7550 CVE-2015-8543 CVE-2015-8575
Debian Bug     : #808293

This update fixes the CVEs described below.

CVE-2015-7550

Dmitry Vyukov discovered a race condition in the keyring subsystem
    that allows a local user to cause a denial of service (crash).

CVE-2015-8543

It was discovered that a local user permitted to create raw sockets
    could cause a denial-of-service by specifying an invalid protocol
    number for the socket. The attacker must have the CAP_NET_RAW
    capability.

CVE-2015-8575

David Miller discovered a flaw in the Bluetooth SCO sockets
    implementation that leads to an information leak to local users.

In addition, this update fixes a regression in the previous update:

#808293

A regression in the UDP implementation prevented freeradius and
    some other applications from receiving data.

For the oldoldstable distribution (squeeze), these problems have been
fixed in version 2.6.32-48squeeze18.

For the oldstable distribution (wheezy), these problems have been
fixed in version 3.2.73-2+deb7u2.

For the stable distribution (jessie), these problems have been fixed
in version 3.16.7-ckt20-1+deb8u2 or earlier.


Ben Hutchings - Debian developer, member of Linux kernel and LTS teams

Attachment:
signature.asc
Description: This is a digitally signed message part

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

44.2%