CVE-2009-0035

CVE-2009-0035 affects alsa-utils 1.0.19 and later, enabling local users to overwrite arbitrary files through a symlink attack on /usr/bin/alsa-info and /usr/bin/alsa-info.sh. The vulnerability arises from improper handling of symlinks in these helper scripts, as documented across multiple sources...

alsa-plugins bug fix and enhancement update

An update is available for alsa-plugins. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-2392)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-17666: rtlp2pnoaie in drivers/net/wireless/realtek/rtlwifi/ps.c lacked a certain upper-bound check, leading to a buffer overflow bnc1154372. - CVE-2019-16232:...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-2307)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-15291: There was a NULL pointer dereference caused by a malicious USB device in the flexcopusbprobe function in the drivers/media/usb/b2c2/flexcop-usb.c driver...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-2308)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-15291: There was a NULL pointer dereference caused by a malicious USB device in the flexcopusbprobe function in the drivers/media/usb/b2c2/flexcop-usb.c driver...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2019:2307-1 Rating: important References: 1051510 1054914 1055117 1061840 1065600 1065729 1071995 1082555 1104967 1109158 1113722 1114279 1119086 1123034 1127988 1131304 1137069 1137865 1137959 1140155...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2019:2308-1 Rating: important References: 1051510 1054914 1055117 1061840 1065600 1065729 1071995 1082555 1104967 1109158 1111666 1113722 1114279 1119086 1123034 1127988 1131304 1137069 1137865 1137959...

CVE-2017-1000380

It was found that the timer functionality in the Linux kernel ALSA subsystem is prone to a race condition between read and ioctl system call handlers, resulting in an uninitialized memory disclosure to user space. A local user could use this flaw to read information belonging to other users...

CVE-2019-15927

An out-of-bounds flaw was found in the ALSA usb-audio subsystem in the Linux kernel. An array boundary check was needed to restrict the array size; failing this can cause an out-of-bound access problem. Data confidentiality and integrity, as well as system availability, are all threats with this...

Oracle Linux 8 : kernel (ELSA-2019-2703)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2703 advisory. - wireless mwifiex: fix 802.11n/WPA detection Jarod Wilson 1714475 1714476 CVE-2019-3846 - x86 x86/entry/64: Use JMP instead of JMPQ Josh Poimboeuf...

kernel: Use-after-free in sound/usb/card.c:usb_audio_probe()

A flaw was found In the Linux kernel, through version 4.19.6, where a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device with zero interfaces that is mishandled in usbaudioprobe in sound/usb/card.c. An attacker could corrupt memory and possibly...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-1924)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction bsc1139358. - CVE-2019-10207: A NULL pointer dereference was possible i...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2019:1924-1 Rating: important References: 1051510 1055117 1071995 1083647 1083710 1085030 1086103 1102247 1106061 1111666 1114279 1119222 1123959 1127034 1127315 1129770 1130972 1131281 1133021 1134097...

NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0007)

The remote NewStart CGSL host, running version MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - It was found that the timer functionality in the Linux kernel ALSA subsystem is prone to a race condition between read and ioctl system call handlers, resulting...

CVE-2019-13351

posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 as distributed with alsa-plugins 1.1.7 and later has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which...

CVE-2019-13351

posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 as distributed with alsa-plugins 1.1.7 and later has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which...

CVE-2019-13351

posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 as distributed with alsa-plugins 1.1.7 and later has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which...

CVE-2019-13351

CVE-2019-13351 affects JACK2 (libjack) shipped with JACK2 1.9.1–1.9.12 (as distributed with alsa-plugins 1.1.7+). The issue is a double file descriptor close in posix/JackSocket.cpp during a failed connection when jackd2 is not running. Exploitation depends on multithreaded timing of the double c...

CVE-2019-13351

posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 as distributed with alsa-plugins 1.1.7 and later has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2019:1571-1 Rating: important References: 1012382 1050242 1051510 1053043 1056787 1058115 1061840 1064802 1065600 1065729 1066129 1068546 1071995 1075020 1082387 1083647 1085535 1093389 1099658 1103992...