CVE-2019-11487

The CVE-2019-11487 issue affects the Linux kernel prior to 5.1-rc5, enabling a page->_refcount overflow that can cause use-after-free when large RAM (≈140 GiB) is present, notably under FUSE workloads (fs/fuse/dev.c, mm/gup.c, mm/hugetlb.c, etc.). Affects multiple kernel components (fs/fuse, f...

CVE-2019-11487

The Linux kernel before 5.1-rc5 allows page-refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipefsi.h, kernel/trace/trace.c, mm/gup.c, and...

CVE-2019-11487

The Linux kernel before 5.1-rc5 allows page-refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipefsi.h, kernel/trace/trace.c, mm/gup.c, and...

CVE-2019-5596

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to ga...

CVE-2019-5596

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to ga...

Android - binder Use-After-Free via fdget() Optimization

This bug report describes two different issues in different branches of the binder kernel code. The first issue is in the upstream Linux kernel, commit 7f3dc0088b98 "binder: fix proc-files use-after-free"; the second issue is in the wahoo kernel and maybe elsewhere? but at least the android commo...

CVE-2019-5596: Undefined Security Weakness

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to ga...

FreeBSD : FreeBSD -- File description reference count leak (86c89abf-2d91-11e9-bf3e-a4badb2f4699)

FreeBSD 12.0 attempts to handle the case where the receiving process does not provide a sufficiently large buffer for an incoming control message containing rights. In particular, to avoid leaking the corresponding descriptors into the receiving process' descriptor table, the kernel handles the...

FreeBSD -- File description reference count leak

Problem Description: FreeBSD 12.0 attempts to handle the case where the receiving process does not provide a sufficiently large buffer for an incoming control message containing rights. In particular, to avoid leaking the corresponding descriptors into the receiving process' descriptor table, the...

SUSE SLES12 Security Update : cups154 (SUSE-SU-2015:1044-1)

The following issues are fixed by this update : - CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server bsc924208. - CVE-2015-1158: Improper Update of Reference Count - CVE-2015-1159: Cross-Site Scripting Note that Tenable...

SUSE SLES12 Security Update : cups154 (SUSE-SU-2015:1044-2)

The following issues are fixed by this update : - CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server bsc924208. - CVE-2015-1158: Improper Update of Reference Count - CVE-2015-1159: Cross-Site Scripting Note that Tenable...

MGASA-2018-0410 Updated dhcp packages fix security vulnerability

Buffer overflow in dhclient possibly allowing code execution triggered by malicious server CVE-2018-5732. Reference count overflow in dhcpd allows denial of service CVE-2018-5733...

Updated dhcp packages fix security vulnerability

Buffer overflow in dhclient possibly allowing code execution triggered by malicious server CVE-2018-5732. Reference count overflow in dhcpd allows denial of service CVE-2018-5733...

SUSE SLES11 Security Update : dhcp (SUSE-SU-2018:0810-2)

This update for dhcp fixes the following issues : Security issues fixed : CVE-2018-5733: reference count overflow in dhcpd bsc1083303. CVE-2018-5732: buffer overflow in dhclient bsc1083302. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

Google Chrome - SwiftShader OpenGL Texture Bindings Reference Count Leak

getRenderTarget; if!renderTarget ERR"Failed to retrieve the render target."; return errorGLOUTOFMEMORY; ifimagelevel imagelevel-release; imagelevel = egl::Image::createthis, width, height, internalformat; if!imagelevel return errorGLOUTOFMEMORY; ifwidth != 0 && height != 0 sw::SliceRect...

Google Chrome - SwiftShader OpenGL Texture Bindings Reference Count Leak

Google Chrome - SwiftShader OpenGL Texture Bindings Reference Count Leak getRenderTarget; if!renderTarget ERR"Failed to retrieve the render target."; return errorGLOUTOFMEMORY; ifimagelevel imagelevel-release; imagelevel = egl::Image::createthis, width, height, internalformat; if!imagelevel retur...

CVE-2018-12232

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sockclose and sockfssetattr functions. fchownat does not increment the file descriptor reference count, which allows...

Amazon Linux AMI : dhcp (ALAS-2018-984)

Buffer overflow in dhclient possibly allowing code execution triggered by malicious server An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client...

Important: dhcp

Issue Overview: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running...

SUSE SLES11 Security Update : dhcp (SUSE-SU-2018:0810-1)

This update for dhcp fixes the following issues: Security issues fixed : - CVE-2018-5733: reference count overflow in dhcpd bsc1083303. - CVE-2018-5732: buffer overflow in dhclient bsc1083302. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...