Marcus Updateinfo to OVAL Converter 5.5 2023-10-19T04:55:51 SUSE Linux Enterprise Micro 5.2 Predictable TCP sequence numbers allow spoofing. Moderate CVE-1999-0077 SUSE bug 954946 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts. Low CVE-1999-0524 SUSE bug 351997 SUSE bug 992991 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in GNU tar 1.13.19 and earlier allows local users to overwrite arbitrary files during archive extraction via a tar file whose filenames contain a .. (dot dot). Low CVE-2001-1267 SUSE bug 1203750 SUSE bug 299738 SUSE bug 299745 SUSE bug 299747 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267. Moderate CVE-2002-0399 SUSE bug 145081 SUSE bug 299738 SUSE bug 299745 SUSE bug 299747 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391. Important CVE-2003-0028 SUSE bug 816627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router is within the range of possible values for data that has already been acknowledged (aka "TCP acknowledgement number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Moderate CVE-2005-0066 SUSE bug 1173637 SUSE bug 1173639 SUSE bug 1173640 SUSE bug 1173642 SUSE bug 1173643 SUSE bug 1173644 SUSE bug 1173645 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/". Moderate CVE-2005-1918 SUSE bug 145081 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.13-rc1 does not initialize certain padding fields in structures, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors, related to the (1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4) neightbl_fill_param_info, (5) neigh_fill_info, (6) rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9) ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11) ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14) tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17) cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20) __rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, and (23) cbq_dump_ovl functions. Moderate CVE-2005-4881 SUSE bug 536467 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and on general-purpose operating systems, allows remote attackers to cause a denial of service (connection slot exhaustion) via a large number of connection attempts that exceeds the MAX_UNAUTH_CLIENTS defined value of 30. Moderate CVE-2006-1206 SUSE bug 802639 SUSE bug 841638 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition. Important CVE-2006-2937 SUSE bug 202366 SUSE bug 207635 SUSE bug 215623 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers. Critical CVE-2006-3738 SUSE bug 202366 SUSE bug 215623 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference. Moderate CVE-2006-4343 SUSE bug 202366 SUSE bug 207635 SUSE bug 215623 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used. Moderate CVE-2006-7246 SUSE bug 1047509 SUSE bug 1047511 SUSE bug 574266 SUSE bug 777228 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message. Moderate CVE-2006-7250 SUSE bug 748738 SUSE bug 883307 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CoolKey 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files in the /tmp/.pk11ipc1/ directory. Low CVE-2007-4129 SUSE bug 304180 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. Moderate CVE-2007-4559 SUSE bug 1203750 SUSE bug 1204077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended header, which allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted IPv6 packet. Important CVE-2007-4567 SUSE bug 307626 SUSE bug 570608 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third party information. Important CVE-2007-5966 SUSE bug 347262 SUSE bug 512584 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6 packet, possibly involving the Jumbo Payload hop-by-hop option (jumbogram). Important CVE-2008-0352 SUSE bug 307626 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow. Important CVE-2008-1420 SUSE bug 372246 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs. Important CVE-2008-1483 SUSE bug 1069509 SUSE bug 373527 SUSE bug 585630 SUSE bug 647633 SUSE bug 706386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference. Moderate CVE-2008-1672 SUSE bug 394317 SUSE bug 404511 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mounting /proc filesystem via chroot command silently mounts it in read-write mode. The user could bypass the chroot environment and gain write access to files, he would never have otherwise. Moderate CVE-2008-2544 SUSE bug 1189500 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries. Moderate CVE-2008-3528 SUSE bug 427244 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl. Critical CVE-2008-3915 SUSE bug 423515 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the do_setlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FL_POSIX lock, related to improper handling of a race between fcntl and close in the EINTR case. Low CVE-2008-4307 SUSE bug 465672 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281. Moderate CVE-2008-4409 SUSE bug 432486 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors. Moderate CVE-2008-5029 SUSE bug 442364 SUSE bug 449739 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. Moderate CVE-2008-5077 SUSE bug 459468 SUSE bug 465675 SUSE bug 465676 SUSE bug 468866 SUSE bug 470968 SUSE bug 475108 SUSE bug 552497 SUSE bug 629905 SUSE bug 708266 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SG_IO requests, which allows local users to cause a denial of service (Programmed I/O mode on drives) via multiple simultaneous invocations of an unspecified test program. Low CVE-2008-5700 SUSE bug 457896 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call. Important CVE-2009-0029 SUSE bug 466015 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID. Critical CVE-2009-0065 SUSE bug 463522 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index. Moderate CVE-2009-0269 SUSE bug 470942 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair. Moderate CVE-2009-0316 SUSE bug 470100 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/. Moderate CVE-2009-0322 SUSE bug 470943 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Niels Provos Systrace before 1.6f on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a syscall number that corresponds to a policy-compliant 32-bit syscall. Important CVE-2009-0342 SUSE bug 483819 SUSE bug 483820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid. Low CVE-2009-0591 SUSE bug 489641 SUSE bug 629905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request. Low CVE-2009-0676 SUSE bug 478002 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation, which might allow local users to cause a denial of service (OOPS) by arranging for crafted values to be present in available memory. Moderate CVE-2009-0745 SUSE bug 480860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak." Important CVE-2009-0778 SUSE bug 482712 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ecryptfs_write_metadata_to_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header, which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory. Moderate CVE-2009-0787 SUSE bug 487107 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343. Important CVE-2009-0834 SUSE bug 483819 SUSE bug 483820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343. Important CVE-2009-0835 SUSE bug 483819 SUSE bug 483820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance. Moderate CVE-2009-0935 SUSE bug 482843 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages. Moderate CVE-2009-1192 SUSE bug 497159 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka "Long mode enable") bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x86_64 platform. Moderate CVE-2009-1242 SUSE bug 492760 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function. Moderate CVE-2009-1336 SUSE bug 492766 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application. Moderate CVE-2009-1337 SUSE bug 1171985 SUSE bug 492768 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers to cause a denial of service (panic) via a crafted frame size. Important CVE-2009-1385 SUSE bug 509822 SUSE bug 567376 SUSE bug 567678 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial of service (kernel memory corruption and crash) via a long packet. Important CVE-2009-1389 SUSE bug 511243 SUSE bug 567376 SUSE bug 567678 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request. Important CVE-2009-1439 SUSE bug 492282 SUSE bug 498824 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c. Important CVE-2009-1633 SUSE bug 492282 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage. Moderate CVE-2009-1883 SUSE bug 539879 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR). Important CVE-2009-1895 SUSE bug 521427 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions. Low CVE-2009-1961 SUSE bug 495065 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size. Moderate CVE-2009-2406 SUSE bug 523719 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet. Moderate CVE-2009-2407 SUSE bug 523719 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mm_for_maps function in fs/proc/base.c in the Linux kernel 2.6.30.4 and earlier allows local users to read (1) maps and (2) smaps files under proc/ via vectors related to ELF loading, a setuid process, and a race condition. Moderate CVE-2009-2691 SUSE bug 529919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket. Important CVE-2009-2698 SUSE bug 532338 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit. Moderate CVE-2009-2848 SUSE bug 527865 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams. Important CVE-2009-2903 SUSE bug 539878 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary directory in an eCryptfs mount. Moderate CVE-2009-2908 SUSE bug 545274 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails. Moderate CVE-2009-3286 SUSE bug 541648 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-0787, CVE-2010-0788, CVE-2010-0789. Reason: this candidate was intended for one issue in Samba, but it was used for multiple distinct issues, including one in FUSE and one in ncpfs. Notes: All CVE users should consult CVE-2010-0787 (Samba), CVE-2010-0788 (ncpfs), and CVE-2010-0789 (FUSE) to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage. Low CVE-2009-3297 SUSE bug 550002 SUSE bug 550003 SUSE bug 550004 SUSE bug 577925 SUSE bug 583535 SUSE bug 583536 SUSE bug 594263 SUSE bug 620680 SUSE bug 651598 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. NOTE: this might overlap CVE-2009-2663. Critical CVE-2009-3379 SUSE bug 522109 SUSE bug 545277 SUSE bug 608192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname. Important CVE-2009-3547 SUSE bug 550001 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files. Low CVE-2009-3556 SUSE bug 572193 SUSE bug 605463 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** main/streams/plain_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe_mode_include_dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations, as demonstrated by a script that attempts to perform a require_once on a file in a standard library directory. NOTE: a reliable third party reports that this is not a vulnerability, because it results in a more restrictive security policy. Important CVE-2009-3559 SUSE bug 557157 SUSE bug 992991 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. Moderate CVE-2009-3620 SUSE bug 548071 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. Moderate CVE-2009-3621 SUSE bug 548070 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands. Moderate CVE-2009-3624 SUSE bug 549030 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function. Important CVE-2009-3638 SUSE bug 550072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625. Moderate CVE-2009-3720 SUSE bug 534721 SUSE bug 550664 SUSE bug 550666 SUSE bug 558892 SUSE bug 561561 SUSE bug 581162 SUSE bug 581765 SUSE bug 611931 SUSE bug 725950 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file. Moderate CVE-2009-3889 SUSE bug 555173 SUSE bug 557180 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file. Moderate CVE-2009-3939 SUSE bug 555173 SUSE bug 557180 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in LibThai before 0.1.13 might allow context-dependent attackers to execute arbitrary code via long strings that trigger heap-based buffer overflows, related to (1) thbrk/thbrk.c and (2) thwbrk/thwbrk.c. NOTE: some of these details are obtained from third party information. Critical CVE-2009-4012 SUSE bug 569615 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecified impact via a crafted Hierarchical File System (HFS) filesystem, related to the hfs_readdir function in fs/hfs/dir.c. Important CVE-2009-4020 SUSE bug 564374 SUSE bug 605463 SUSE bug 760902 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (panic) via a crafted Delete Block ACK (aka DELBA) packet, related to an erroneous "code shuffling patch." Important CVE-2009-4026 SUSE bug 558267 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session. Important CVE-2009-4027 SUSE bug 558267 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid, which allows guest OS users to cause a denial of service (increased scheduling latency) on the host OS via unspecified manipulations related to SMP support. Important CVE-2009-4031 SUSE bug 558269 SUSE bug 558662 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or take full control of the system. Low CVE-2009-4067 SUSE bug 706375 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel before 2.6.32-git6 allows local users to overwrite arbitrary files via a crafted request, related to insufficient checks for file permissions. Important CVE-2009-4131 SUSE bug 561018 SUSE bug 564380 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability than CVE-2009-4131. Moderate CVE-2009-4306 SUSE bug 564380 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value). Important CVE-2009-4307 SUSE bug 564381 SUSE bug 757278 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal. Important CVE-2009-4308 SUSE bug 564382 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385. Important CVE-2009-4536 SUSE bug 567376 SUSE bug 583434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389. Important CVE-2009-4537 SUSE bug 567376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537. Critical CVE-2009-4538 SUSE bug 567376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969. Low CVE-2009-5081 SUSE bug 703666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match. Low CVE-2009-5155 SUSE bug 1127223 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address. Moderate CVE-2010-0003 SUSE bug 569902 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.32.4, when network namespaces are enabled, allows remote attackers to cause a denial of service (NULL pointer dereference) via an invalid IPv6 jumbogram, a related issue to CVE-2007-4567. Important CVE-2010-0006 SUSE bug 570608 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/bridge/netfilter/ebtables.c in the ebtables module in the netfilter framework in the Linux kernel before 2.6.33-rc4 does not require the CAP_NET_ADMIN capability for setting or modifying rules, which allows local users to bypass intended access restrictions and configure arbitrary network-traffic filtering via a modified ebtables application. Moderate CVE-2010-0007 SUSE bug 570602 SUSE bug 570606 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length. Important CVE-2010-0008 SUSE bug 586195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function. Moderate CVE-2010-0307 SUSE bug 575644 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages. Moderate CVE-2010-0410 SUSE bug 576927 SUSE bug 605463 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set. Moderate CVE-2010-0415 SUSE bug 577753 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count, which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem. Moderate CVE-2010-0623 SUSE bug 579439 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (colon) character. Moderate CVE-2010-0624 SUSE bug 579475 SUSE bug 608034 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation. Low CVE-2010-0730 SUSE bug 601231 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated qemu-kvm process exit) by sending a large amount of network traffic to a TCP port on the guest OS, related to a virtio-net whitelist that includes an improper implementation of TCP Segment Offloading (TSO). Important CVE-2010-0741 SUSE bug 596032 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions. Moderate CVE-2010-1148 SUSE bug 593940 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors. Important CVE-2010-1162 SUSE bug 596462 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. Important CVE-2010-1173 SUSE bug 600375 SUSE bug 702025 SUSE bug 941110 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed. Important CVE-2010-1188 SUSE bug 592571 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file system to a gfs2 file system. Moderate CVE-2010-1436 SUSE bug 599957 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function. Low CVE-2010-1437 SUSE bug 599955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information. Moderate CVE-2010-1633 SUSE bug 610642 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request. Moderate CVE-2010-1641 SUSE bug 608576 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. Moderate CVE-2010-1643 SUSE bug 608933 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a MOVE_EXT ioctl call that specifies this file as a donor. Moderate CVE-2010-2066 SUSE bug 612457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file. Moderate CVE-2010-2226 SUSE bug 615141 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server. Important CVE-2010-2240 SUSE bug 1039348 SUSE bug 211997 SUSE bug 546062 SUSE bug 59807 SUSE bug 615929 SUSE bug 618152 SUSE bug 632737 SUSE bug 643986 SUSE bug 746947 SUSE bug 746949 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum, a different vulnerability than CVE-2008-5081. Moderate CVE-2010-2244 SUSE bug 603289 SUSE bug 646961 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions. Important CVE-2010-2248 SUSE bug 618156 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors. Important CVE-2010-2492 SUSE bug 619850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pppol2tp_xmit function in drivers/net/pppol2tp.c in the L2TP implementation in the Linux kernel before 2.6.34 does not properly validate certain values associated with an interface, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors related to a routing change. Critical CVE-2010-2495 SUSE bug 616612 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions. Critical CVE-2010-2521 SUSE bug 620372 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals. Important CVE-2010-2524 SUSE bug 627386 SUSE bug 627447 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c. Important CVE-2010-2798 SUSE bug 627386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount. Important CVE-2010-2803 SUSE bug 628604 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c. Moderate CVE-2010-2942 SUSE bug 632309 SUSE bug 642324 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle. Important CVE-2010-2943 SUSE bug 632317 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The irda_bind function in net/irda/af_irda.c in the Linux kernel before 2.6.36-rc3-next-20100901 does not properly handle failure of the irda_open_tsap function, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via multiple unsuccessful calls to bind on an AF_IRDA (aka PF_IRDA) socket. Moderate CVE-2010-2954 SUSE bug 636112 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The io_submit_one function in fs/aio.c in the Linux kernel before 2.6.23 allows local users to cause a denial of service (NULL pointer dereference) via a crafted io_submit system call with an IOCB_FLAG_RESFD flag. Moderate CVE-2010-3066 SUSE bug 657944 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call. Moderate CVE-2010-3067 SUSE bug 642302 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call. Moderate CVE-2010-3078 SUSE bug 637436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the set_ftrace_filter file. Moderate CVE-2010-3079 SUSE bug 637502 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device. Important CVE-2010-3080 SUSE bug 638277 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010. Important CVE-2010-3081 SUSE bug 639709 SUSE bug 641575 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command. Important CVE-2010-3084 SUSE bug 638274 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 include/asm-x86/futex.h in the Linux kernel before 2.6.25 does not properly implement exception fixup, which allows local users to cause a denial of service (panic) via an invalid application that triggers a page fault. Moderate CVE-2010-3086 SUSE bug 652595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv[0] and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program that contains a stack-based buffer overflow error, related to the __fortify_fail function in debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection) and __chk_fail (aka FORTIFY_SOURCE) implementations. Moderate CVE-2010-3192 SUSE bug 636113 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call. Low CVE-2010-3296 SUSE bug 639481 SUSE bug 649187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call. Low CVE-2010-3297 SUSE bug 639482 SUSE bug 649187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call. Low CVE-2010-3298 SUSE bug 639483 SUSE bug 649187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures, which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic. Important CVE-2010-3432 SUSE bug 641983 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call. Moderate CVE-2010-3437 SUSE bug 642486 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. Moderate CVE-2010-3442 SUSE bug 642484 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT). Moderate CVE-2010-3698 SUSE bug 1161450 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array. Important CVE-2010-3705 SUSE bug 643513 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform, which allows local users to cause a denial of service (system crash) via a crafted exec system call, a related issue to CVE-2010-2240. Moderate CVE-2010-3858 SUSE bug 648302 SUSE bug 655220 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478. Low CVE-2010-3861 SUSE bug 649187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow. Important CVE-2010-3865 SUSE bug 650128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ax25_getname function in net/ax25/af_ax25.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure. Important CVE-2010-3875 SUSE bug 650897 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/packet/af_packet.c in the Linux kernel before 2.6.37-rc2 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_RAW capability to read copies of the applicable structures. Important CVE-2010-3876 SUSE bug 650897 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure. Important CVE-2010-3877 SUSE bug 650897 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions. Moderate CVE-2010-3880 SUSE bug 651599 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device. Low CVE-2010-3881 SUSE bug 651596 SUSE bug 662663 SUSE bug 706696 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. Important CVE-2010-3904 SUSE bug 647392 SUSE bug 676707 SUSE bug 703752 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel before 2.6.36-rc6 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call. Low CVE-2010-4078 SUSE bug 642311 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call. Low CVE-2010-4080 SUSE bug 642312 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call. Low CVE-2010-4081 SUSE bug 642312 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter. Low CVE-2010-4158 SUSE bug 652563 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call. Moderate CVE-2010-4160 SUSE bug 652939 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device. Moderate CVE-2010-4162 SUSE bug 652945 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.36.2 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device. Moderate CVE-2010-4163 SUSE bug 652945 SUSE bug 662202 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer. Moderate CVE-2010-4165 SUSE bug 653258 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in mm/mprotect.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors involving an mprotect system call. Moderate CVE-2010-4169 SUSE bug 653930 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an "OOM dodging issue," a related issue to CVE-2010-3858. Moderate CVE-2010-4243 SUSE bug 655220 SUSE bug 746947 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c. Moderate CVE-2010-4248 SUSE bug 655468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage collection of inflight sockets, which allows local users to cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for SOCK_SEQPACKET sockets. Moderate CVE-2010-4249 SUSE bug 655696 SUSE bug 656153 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests. Important CVE-2010-4251 SUSE bug 643138 SUSE bug 655973 SUSE bug 826455 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call. Important CVE-2010-4258 SUSE bug 657350 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame. Important CVE-2010-4263 SUSE bug 657716 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file. Moderate CVE-2010-4343 SUSE bug 658178 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application. Moderate CVE-2010-4346 SUSE bug 658720 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c. Important CVE-2010-4347 SUSE bug 659076 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call. Moderate CVE-2010-4527 SUSE bug 661945 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename. Low CVE-2010-4565 SUSE bug 1161355 SUSE bug 651218 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member. Moderate CVE-2010-4649 SUSE bug 662953 SUSE bug 690537 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service by sending a large amount of network traffic, related to the sk_add_backlog function and the sk_rmem_alloc socket field. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251. Important CVE-2010-4805 SUSE bug 698190 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections. Moderate CVE-2010-5107 SUSE bug 1074631 SUSE bug 802639 SUSE bug 841638 SUSE bug 858359 SUSE bug 880259 SUSE bug 881234 SUSE bug 992991 SUSE bug 996040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842. Moderate CVE-2010-5313 SUSE bug 905312 SUSE bug 907822 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of service (memory consumption) by leveraging /dev/video access for a series of mmap calls that require new allocations, a different vulnerability than CVE-2007-6761. NOTE: as of 2016-06-18, this affects only 11 drivers that have not been updated to use videobuf2 instead of videobuf. Moderate CVE-2010-5321 SUSE bug 1035720 SUSE bug 916831 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least one Linux maintainer believes that this CVE is incorrectly assigned and should be rejected because the value is hard coded and are not user-controllable where it is used. Critical CVE-2010-5331 SUSE bug 1143173 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access. Critical CVE-2010-5332 SUSE bug 1143170 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ocfs2_prepare_page_for_write function in fs/ocfs2/aops.c in the Oracle Cluster File System 2 (OCFS2) subsystem in the Linux kernel before 2.6.39-rc1 does not properly handle holes that cross page boundaries, which allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file. Moderate CVE-2011-0463 SUSE bug 670595 SUSE bug 673037 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value. Important CVE-2011-0521 SUSE bug 666836 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack. Low CVE-2011-0541 SUSE bug 668820 SUSE bug 685055 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/. Moderate CVE-2011-0710 SUSE bug 672492 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call. Moderate CVE-2011-0711 SUSE bug 672505 SUSE bug 672524 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c. Important CVE-2011-0712 SUSE bug 672499 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary. Low CVE-2011-0726 SUSE bug 701254 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge page (THP) during the existence of a temporary stack for an exec system call, which allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted application. Moderate CVE-2011-0999 SUSE bug 1183531 SUSE bug 673261 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a malformed Mac OS partition table. Moderate CVE-2011-1010 SUSE bug 673929 SUSE bug 690537 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values. Moderate CVE-2011-1016 SUSE bug 674691 SUSE bug 674693 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table. Important CVE-2011-1017 SUSE bug 674648 SUSE bug 698221 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls. Moderate CVE-2011-1020 SUSE bug 674982 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash) via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit operation. Moderate CVE-2011-1023 SUSE bug 676707 SUSE bug 703752 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option. Low CVE-2011-1078 SUSE bug 676601 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line. Low CVE-2011-1080 SUSE bug 676602 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls. Moderate CVE-2011-1082 SUSE bug 676202 SUSE bug 690537 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls. Moderate CVE-2011-1083 SUSE bug 676204 SUSE bug 690537 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL. Moderate CVE-2011-1090 SUSE bug 677286 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet. Important CVE-2011-1093 SUSE bug 677676 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place. Low CVE-2011-1098 SUSE bug 1007000 SUSE bug 1136195 SUSE bug 677335 SUSE bug 677336 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. Moderate CVE-2011-1154 SUSE bug 677335 SUSE bug 679661 SUSE bug 681984 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. Low CVE-2011-1155 SUSE bug 677335 SUSE bug 679662 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors. Low CVE-2011-1160 SUSE bug 680040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command. Low CVE-2011-1162 SUSE bug 680040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing. Low CVE-2011-1163 SUSE bug 679812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index value that triggers access to an invalid kernel pointer. Important CVE-2011-1169 SUSE bug 680816 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process. Low CVE-2011-1170 SUSE bug 681180 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process. Low CVE-2011-1171 SUSE bug 681181 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process. Low CVE-2011-1172 SUSE bug 681185 SUSE bug 693976 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call. Moderate CVE-2011-1182 SUSE bug 681826 SUSE bug 690537 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2011-1410 SUSE bug 706386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame. Moderate CVE-2011-1478 SUSE bug 682965 SUSE bug 698450 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the inotify subsystem in the Linux kernel before 2.6.39 allows local users to cause a denial of service (system crash) via vectors involving failed attempts to create files. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-4250. Moderate CVE-2011-1479 SUSE bug 655693 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket. Important CVE-2011-1493 SUSE bug 681175 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow. Moderate CVE-2011-1494 SUSE bug 685402 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions. Important CVE-2011-1495 SUSE bug 685402 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunks, which allows remote attackers to cause a denial of service (OOPS) via crafted packet data. Moderate CVE-2011-1573 SUSE bug 686813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478. Moderate CVE-2011-1576 SUSE bug 698450 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media. Moderate CVE-2011-1577 SUSE bug 687113 SUSE bug 692784 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel before 2.6.36 does not properly determine the associations between users and sessions, which allows local users to bypass CIFS share authentication by leveraging a mount of a share by a different user. Low CVE-2011-1585 SUSE bug 687812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation. Moderate CVE-2011-1598 SUSE bug 688685 SUSE bug 689038 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call. Moderate CVE-2011-1745 SUSE bug 689797 SUSE bug 693043 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not properly restrict memory allocation by the (1) AGPIOC_RESERVE and (2) AGPIOC_ALLOCATE ioctls, which allows local users to cause a denial of service (memory consumption) by making many calls to these ioctls. Moderate CVE-2011-1747 SUSE bug 689797 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv4/ip_gre.c in the Linux kernel before 2.6.34, when ip_gre is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading. Moderate CVE-2011-1767 SUSE bug 692239 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cifs_close function in fs/cifs/file.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS filesystem. Important CVE-2011-1771 SUSE bug 692497 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577. Moderate CVE-2011-1776 SUSE bug 692784 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the ecryptfs_mount function in fs/ecryptfs/main.c in the eCryptfs subsystem in the Linux kernel before 3.1 allows local users to bypass intended file permissions via a mount.ecryptfs_private mount with a mismatched uid. Moderate CVE-2011-1833 SUSE bug 709771 SUSE bug 711539 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd. Important CVE-2011-2189 SUSE bug 698449 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel before 2.6.39.3 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880. Moderate CVE-2011-2213 SUSE bug 700879 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A certain Red Hat patch to the sctp_sock_migrate function in net/sctp/socket.c in the Linux kernel before 2.6.21, as used in Red Hat Enterprise Linux (RHEL) 5, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted SCTP packet. Important CVE-2011-2482 SUSE bug 735611 SUSE bug 750395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The add_del_listener function in kernel/taskstats.c in the Linux kernel 2.6.39.1 and earlier does not prevent multiple registrations of exit handlers, which allows local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application. Moderate CVE-2011-2484 SUSE bug 703153 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call. Moderate CVE-2011-2491 SUSE bug 702013 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c. Moderate CVE-2011-2492 SUSE bug 702014 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password. Low CVE-2011-2494 SUSE bug 703156 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow. Important CVE-2011-2497 SUSE bug 702286 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value. Important CVE-2011-2517 SUSE bug 703410 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call. Important CVE-2011-2525 SUSE bug 735612 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space. Moderate CVE-2011-2689 SUSE bug 710672 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer. Moderate CVE-2011-2695 SUSE bug 706374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets. Important CVE-2011-2699 SUSE bug 707288 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request. Moderate CVE-2011-2707 SUSE bug 707337 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain packet data structures associated with VLAN Tag Control Information, which allows local users to obtain potentially sensitive information via a crafted application. Moderate CVE-2011-2898 SUSE bug 710235 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Untrusted search path vulnerability in the perf_config function in tools/perf/util/config.c in perf, as distributed in the Linux kernel before 3.1, allows local users to overwrite arbitrary files via a crafted config file in the current working directory. Moderate CVE-2011-2905 SUSE bug 711414 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application. Moderate CVE-2011-2918 SUSE bug 712366 SUSE bug 713650 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A certain Red Hat patch to the __br_deliver function in net/bridge/br_forward.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging connectivity to a network interface that uses an Ethernet bridge device. Moderate CVE-2011-2942 SUSE bug 726064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets. Critical CVE-2011-3188 SUSE bug 713650 SUSE bug 737874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame. Important CVE-2011-3359 SUSE bug 717749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share. Moderate CVE-2011-3363 SUSE bug 718028 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A certain Red Hat patch to the vlan_hwaccel_do_receive function in net/8021q/vlan_core.c in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames. Moderate CVE-2011-3593 SUSE bug 735347 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket. Moderate CVE-2011-4081 SUSE bug 726788 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal. Moderate CVE-2011-4086 SUSE bug 745832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Moderate CVE-2011-4108 SUSE bug 739719 SUSE bug 742821 SUSE bug 758060 SUSE bug 778825 SUSE bug 854391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key." Moderate CVE-2011-4110 SUSE bug 734056 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The NFSv4 implementation in the Linux kernel before 3.2.2 does not properly handle bitmap sizes in GETACL replies, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words. Moderate CVE-2011-4131 SUSE bug 730117 SUSE bug 762992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value." Low CVE-2011-4132 SUSE bug 730118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The encode_share_access function in fs/nfs/nfs4xdr.c in the Linux kernel before 2.6.29 allows local users to cause a denial of service (BUG and system crash) by using the mknod system call with a pathname on an NFSv4 filesystem. Moderate CVE-2011-4324 SUSE bug 732613 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device. Important CVE-2011-4326 SUSE bug 732021 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets. NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482. Important CVE-2011-4348 SUSE bug 750395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. Moderate CVE-2011-4576 SUSE bug 739719 SUSE bug 758060 SUSE bug 778825 SUSE bug 854391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System (AS) identifiers. Moderate CVE-2011-4577 SUSE bug 739719 SUSE bug 758060 SUSE bug 854391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference. Moderate CVE-2011-4594 SUSE bug 735810 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bat_socket_read function in net/batman-adv/icmp_socket.c in the Linux kernel before 3.3 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted batman-adv ICMP packet. Moderate CVE-2011-4604 SUSE bug 736149 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events. Moderate CVE-2011-4611 SUSE bug 744023 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. Moderate CVE-2011-4619 SUSE bug 739719 SUSE bug 758060 SUSE bug 799454 SUSE bug 854391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant. Low CVE-2011-5000 SUSE bug 755505 SUSE bug 756370 SUSE bug 826672 SUSE bug 881234 SUSE bug 996040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tty_open function in drivers/tty/tty_io.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted access to a device file under the /dev/pts directory. Moderate CVE-2011-5321 SUSE bug 922447 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client. Moderate CVE-2012-0027 SUSE bug 739719 SUSE bug 854391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process. Important CVE-2012-0028 SUSE bug 739721 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper. Moderate CVE-2012-0056 SUSE bug 1171985 SUSE bug 742028 SUSE bug 742279 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The kiocb_batch_free function in fs/aio.c in the Linux kernel before 3.2.2 allows local users to cause a denial of service (OOPS) via vectors that trigger incorrect iocb management. Moderate CVE-2012-0058 SUSE bug 742030 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file. Critical CVE-2012-0444 SUSE bug 744275 SUSE bug 747912 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention. Moderate CVE-2012-0810 SUSE bug 749118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value. Moderate CVE-2012-0876 SUSE bug 750914 SUSE bug 751464 SUSE bug 751465 SUSE bug 983215 SUSE bug 983216 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context. Moderate CVE-2012-0879 SUSE bug 748812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. Moderate CVE-2012-0957 SUSE bug 783515 SUSE bug 783606 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cifs_lookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service (OOPS) via attempted access to a special file, as demonstrated by a FIFO. Moderate CVE-2012-1090 SUSE bug 749569 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow. Moderate CVE-2012-1173 SUSE bug 753362 SUSE bug 767852 SUSE bug 854393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets. Moderate CVE-2012-1583 SUSE bug 757707 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. Moderate CVE-2012-2113 SUSE bug 767852 SUSE bug 854393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length. Moderate CVE-2012-2119 SUSE bug 758243 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices. Moderate CVE-2012-2121 SUSE bug 758355 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR. Important CVE-2012-2123 SUSE bug 758260 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONE_NEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon that uses PID namespaces to isolate clients, as demonstrated by vsftpd. Important CVE-2012-2127 SUSE bug 757783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data. Moderate CVE-2012-2133 SUSE bug 758532 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device. Important CVE-2012-2136 SUSE bug 765320 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function. Moderate CVE-2012-2137 SUSE bug 767612 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call. Moderate CVE-2012-2313 SUSE bug 758813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping. Moderate CVE-2012-2372 SUSE bug 767610 SUSE bug 795039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131. Moderate CVE-2012-2375 SUSE bug 762992 SUSE bug 851103 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the i915_gem_execbuffer2 function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call. Moderate CVE-2012-2383 SUSE bug 763194 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call. Moderate CVE-2012-2384 SUSE bug 763194 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations. Moderate CVE-2012-2390 SUSE bug 764150 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets. Important CVE-2012-2744 SUSE bug 770697 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call. Moderate CVE-2012-2745 SUSE bug 770695 SUSE bug 795039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083. Moderate CVE-2012-3375 SUSE bug 769896 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405. Moderate CVE-2012-3406 SUSE bug 770891 SUSE bug 826666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket. Low CVE-2012-3430 SUSE bug 773383 SUSE bug 795039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager. Low CVE-2012-3520 SUSE bug 776925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic. Important CVE-2012-3552 SUSE bug 778460 SUSE bug 795039 SUSE bug 827565 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application. Moderate CVE-2012-4398 SUSE bug 778463 SUSE bug 779488 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments. Moderate CVE-2012-4444 SUSE bug 789831 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl. Low CVE-2012-4461 SUSE bug 787821 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized. Low CVE-2012-4508 SUSE bug 784192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Low CVE-2012-4530 SUSE bug 786013 SUSE bug 841063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes. Moderate CVE-2012-4542 SUSE bug 807154 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow. Moderate CVE-2012-4564 SUSE bug 781995 SUSE bug 787892 SUSE bug 791607 SUSE bug 854393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats. Moderate CVE-2012-4565 SUSE bug 787576 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface. Important CVE-2012-5519 SUSE bug 1180148 SUSE bug 789566 SUSE bug 882905 SUSE bug 924208 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Low CVE-2012-6539 SUSE bug 809891 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument. Low CVE-2012-6542 SUSE bug 809894 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation. Low CVE-2012-6544 SUSE bug 809898 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application. Low CVE-2012-6545 SUSE bug 809899 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Low CVE-2012-6546 SUSE bug 809900 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Low CVE-2012-6547 SUSE bug 809901 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. Low CVE-2012-6548 SUSE bug 809902 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. Low CVE-2012-6549 SUSE bug 809903 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command. Moderate CVE-2012-6647 SUSE bug 878289 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with a stream socket, which allows local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket. Moderate CVE-2012-6657 SUSE bug 896779 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. Moderate CVE-2012-6701 SUSE bug 969354 SUSE bug 969355 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function. Moderate CVE-2012-6702 SUSE bug 983215 SUSE bug 983216 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call. Low CVE-2012-6703 SUSE bug 986811 SUSE bug 986941 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option. Moderate CVE-2012-6704 SUSE bug 1013531 SUSE bug 1013542 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. Moderate CVE-2013-0216 SUSE bug 800280 SUSE bug 800801 SUSE bug 801178 SUSE bug 841063 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions. Moderate CVE-2013-0217 SUSE bug 800280 SUSE bug 800801 SUSE bug 801178 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application. Moderate CVE-2013-0228 SUSE bug 801179 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application. Moderate CVE-2013-0290 SUSE bug 803931 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application. Moderate CVE-2013-0309 SUSE bug 804652 SUSE bug 841063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call. Moderate CVE-2013-0310 SUSE bug 1133087 SUSE bug 804653 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages. Low CVE-2013-0343 SUSE bug 805226 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death. Important CVE-2013-0871 SUSE bug 804154 SUSE bug 804227 SUSE bug 841063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call. Low CVE-2013-0914 SUSE bug 808827 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call. Low CVE-2013-1772 SUSE bug 806238 SUSE bug 807441 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion. Moderate CVE-2013-1773 SUSE bug 806977 SUSE bug 807452 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter. Moderate CVE-2013-1774 SUSE bug 806976 SUSE bug 807455 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map. Moderate CVE-2013-1819 SUSE bug 807471 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability. Moderate CVE-2013-1826 SUSE bug 809889 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call. Moderate CVE-2013-1827 SUSE bug 811354 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device. Moderate CVE-2013-1860 SUSE bug 806431 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2634, CVE-2013-2635, CVE-2013-2636. Reason: This candidate is a duplicate of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636. Notes: All CVE users should reference one or more of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Low CVE-2013-1873 SUSE bug 810473 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device. Moderate CVE-2013-1928 SUSE bug 813735 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure. Moderate CVE-2013-1929 SUSE bug 813733 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c. Important CVE-2013-1943 SUSE bug 828012 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file. Critical CVE-2013-1960 SUSE bug 817573 SUSE bug 854393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file. Critical CVE-2013-1961 SUSE bug 817573 SUSE bug 818117 SUSE bug 854393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application. Moderate CVE-2013-1979 SUSE bug 816708 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries, (2) XcupStoreColors, (3) XdbeGetVisualInfo, (4) XeviGetVisualInfo, (5) XShapeGetRectangles, and (6) XSyncListSystemCounters functions. Moderate CVE-2013-1982 SUSE bug 815451 SUSE bug 821665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in X.org libXfixes 5.0 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XFixesGetCursorImage function. Moderate CVE-2013-1983 SUSE bug 815451 SUSE bug 821667 SUSE bug 880221 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in X.org libXi 1.7.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XGetDeviceControl, (2) XGetFeedbackControl, (3) XGetDeviceDontPropagateList, (4) XGetDeviceMotionEvents, (5) XIGetProperty, (6) XIGetSelectedEvents, (7) XGetDeviceProperties, and (8) XListInputDevices functions. Moderate CVE-2013-1984 SUSE bug 815451 SUSE bug 821663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in X.org libXinerama 1.1.2 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XineramaQueryScreens function. Moderate CVE-2013-1985 SUSE bug 815451 SUSE bug 821663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRRQueryOutputProperty and (2) XRRQueryProviderProperty functions. Moderate CVE-2013-1986 SUSE bug 815451 SUSE bug 821663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRenderQueryFilters, (2) XRenderQueryFormats, and (3) XRenderQueryPictIndexValues functions. Moderate CVE-2013-1987 SUSE bug 815451 SUSE bug 821669 SUSE bug 880221 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in X.org libXv 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvQueryPortAttributes, (2) XvListImageFormats, and (3) XvCreateImage function. Moderate CVE-2013-1989 SUSE bug 815451 SUSE bug 821671 SUSE bug 880221 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 X.org libXi 1.7.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to an unexpected sign extension in the XListInputDevices function. Moderate CVE-2013-1995 SUSE bug 815451 SUSE bug 821663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in X.org libXi 1.7.1 and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XGetDeviceButtonMapping, (2) XIPassiveGrabDevice, and (3) XQueryDeviceState functions. Moderate CVE-2013-1998 SUSE bug 815451 SUSE bug 821663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function. Moderate CVE-2013-2003 SUSE bug 1065386 SUSE bug 815451 SUSE bug 821663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test. Low CVE-2013-2015 SUSE bug 817377 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in X.org libXtst 1.2.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XRecordGetContext function. Moderate CVE-2013-2063 SUSE bug 815451 SUSE bug 821663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvQueryPortAttributes function. Moderate CVE-2013-2066 SUSE bug 815451 SUSE bug 821671 SUSE bug 880221 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call. Important CVE-2013-2094 SUSE bug 819789 SUSE bug 820202 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket. Moderate CVE-2013-2128 SUSE bug 822583 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call. Low CVE-2013-2141 SUSE bug 823267 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit. Moderate CVE-2013-2146 SUSE bug 825006 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic. Important CVE-2013-2206 SUSE bug 781018 SUSE bug 826102 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface. Important CVE-2013-2232 SUSE bug 827750 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket. Low CVE-2013-2234 SUSE bug 827749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket. Moderate CVE-2013-2237 SUSE bug 828119 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Low CVE-2013-2634 SUSE bug 810473 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Low CVE-2013-2635 SUSE bug 810473 SUSE bug 871595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted JPEG2000 image. Critical CVE-2013-2869 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response traffic after a URL request. Critical CVE-2013-2870 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input. Critical CVE-2013-2871 SUSE bug 828893 SUSE bug 871792 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for renderer processes, which might make it easier for remote attackers to defeat cryptographic protection mechanisms in third-party components via unspecified vectors. Critical CVE-2013-2872 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources. Critical CVE-2013-2873 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Google Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers to bypass intended restrictions on access to screen data via vectors involving IPC transmission of GL textures. Critical CVE-2013-2874 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink, as used in Google Chrome before 28.0.1500.71, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. Critical CVE-2013-2875 SUSE bug 828893 SUSE bug 879607 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 browser/extensions/api/tabs/tabs_api.cc in Google Chrome before 28.0.1500.71 does not properly enforce restrictions on the capture of screenshots by extensions, which allows remote attackers to obtain sensitive information about the content of a previous page via vectors involving an interstitial page. Critical CVE-2013-2876 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state. Critical CVE-2013-2877 SUSE bug 1123919 SUSE bug 828893 SUSE bug 829077 SUSE bug 854869 SUSE bug 877506 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the handling of text. Critical CVE-2013-2878 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Google Chrome before 28.0.1500.71 does not properly determine the circumstances in which a renderer process can be considered a trusted process for sign-in and subsequent sync operations, which makes it easier for remote attackers to conduct phishing attacks via a crafted web site. Critical CVE-2013-2879 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Critical CVE-2013-2880 SUSE bug 828893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID. Moderate CVE-2013-2888 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device. Moderate CVE-2013-2889 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-sony.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SONY is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device. Moderate CVE-2013-2890 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device. Moderate CVE-2013-2891 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device. Moderate CVE-2013-2892 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c. Moderate CVE-2013-2893 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-lenovo-tpkbd.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device. Moderate CVE-2013-2894 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device. Moderate CVE-2013-2895 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device. Moderate CVE-2013-2896 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device. Moderate CVE-2013-2897 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device. Moderate CVE-2013-2898 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device. Moderate CVE-2013-2899 SUSE bug 835839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h. Low CVE-2013-2929 SUSE bug 824295 SUSE bug 847652 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c. Moderate CVE-2013-3076 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3222 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3223 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3224 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sco_sock_recvmsg function in net/bluetooth/sco.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3226 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3227 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3228 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3229 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The l2tp_ip6_recvmsg function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.9-rc7 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3230 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3231 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3232 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3233 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3234 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Moderate CVE-2013-3235 SUSE bug 816668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call. Moderate CVE-2013-3301 SUSE bug 815256 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI). Moderate CVE-2013-3495 SUSE bug 826717 SUSE bug 903970 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport, (2) lowport, (3) range, or (4) tcpwrap restrictions. Low CVE-2013-3571 SUSE bug 821985 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call. Moderate CVE-2013-4162 SUSE bug 831058 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call. Moderate CVE-2013-4163 SUSE bug 831055 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size. Moderate CVE-2013-4231 SUSE bug 834477 SUSE bug 854393 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image. Moderate CVE-2013-4232 SUSE bug 834477 SUSE bug 854393 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted height and width values in a GIF image. Moderate CVE-2013-4243 SUSE bug 834779 SUSE bug 854393 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image. Moderate CVE-2013-4244 SUSE bug 834788 SUSE bug 854393 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application. Low CVE-2013-4270 SUSE bug 836949 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. Important CVE-2013-4282 SUSE bug 848279 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck. Moderate CVE-2013-4288 SUSE bug 1070943 SUSE bug 1099031 SUSE bug 835827 SUSE bug 836931 SUSE bug 836932 SUSE bug 836937 SUSE bug 836939 SUSE bug 844967 SUSE bug 852368 SUSE bug 854144 SUSE bug 864716 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288. Moderate CVE-2013-4311 SUSE bug 836931 SUSE bug 838638 SUSE bug 864716 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. Moderate CVE-2013-4312 SUSE bug 1020452 SUSE bug 839104 SUSE bug 922947 SUSE bug 968014 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network. Moderate CVE-2013-4350 SUSE bug 840506 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet. Moderate CVE-2013-4387 SUSE bug 843430 SUSE bug 848042 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914. Moderate CVE-2013-4458 SUSE bug 1123874 SUSE bug 847227 SUSE bug 883217 SUSE bug 941444 SUSE bug 955181 SUSE bug 967023 SUSE bug 980483 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application. Moderate CVE-2013-4483 SUSE bug 848321 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image. Important CVE-2013-4533 SUSE bug 1072223 SUSE bug 864655 SUSE bug 871442 SUSE bug 964644 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements. Important CVE-2013-4534 SUSE bug 864811 SUSE bug 871442 SUSE bug 964452 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image. Important CVE-2013-4537 SUSE bug 864391 SUSE bug 871442 SUSE bug 962642 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image. Important CVE-2013-4538 SUSE bug 1072223 SUSE bug 864769 SUSE bug 871442 SUSE bug 962335 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image. Important CVE-2013-4539 SUSE bug 1072223 SUSE bug 864805 SUSE bug 871442 SUSE bug 962758 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image. Important CVE-2013-4540 SUSE bug 864801 SUSE bug 871442 SUSE bug 880751 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the original MAC address after spoofing by sending a series of packets to MAC addresses with certain bit manipulations. Moderate CVE-2013-4579 SUSE bug 851426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value. Important CVE-2013-4587 SUSE bug 853050 SUSE bug 882914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted image file. Moderate CVE-2013-6369 SUSE bug 870855 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors. Moderate CVE-2013-6370 SUSE bug 870147 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions. Moderate CVE-2013-6371 SUSE bug 870147 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode. Moderate CVE-2013-6376 SUSE bug 853053 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size. Moderate CVE-2013-6381 SUSE bug 852552 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document. Moderate CVE-2013-6401 SUSE bug 863301 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** The IsHandleEntrySecure function in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 SP2 does not properly validate the tagPROCESSINFO pW32Job field, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted NtUserValidateHandleSecure call for an owned object. NOTE: the vendor reportedly disputes the significance of this report, stating that "it appears to be a local DOS ... we don't consider it a security vulnerability." Important CVE-2013-6999 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read. Moderate CVE-2013-7038 SUSE bug 854443 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header. Moderate CVE-2013-7039 SUSE bug 854443 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack. Moderate CVE-2013-7041 SUSE bug 1123794 SUSE bug 1215217 SUSE bug 854480 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. Important CVE-2013-7263 SUSE bug 853040 SUSE bug 857643 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. Moderate CVE-2013-7264 SUSE bug 853040 SUSE bug 857643 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. Moderate CVE-2013-7265 SUSE bug 853040 SUSE bug 857643 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. Moderate CVE-2013-7267 SUSE bug 854722 SUSE bug 857643 SUSE bug 882914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. Moderate CVE-2013-7268 SUSE bug 854722 SUSE bug 857643 SUSE bug 882914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. Moderate CVE-2013-7269 SUSE bug 854722 SUSE bug 857643 SUSE bug 882914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. Moderate CVE-2013-7270 SUSE bug 854722 SUSE bug 857643 SUSE bug 882914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. Moderate CVE-2013-7271 SUSE bug 854722 SUSE bug 857643 SUSE bug 882914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. Moderate CVE-2013-7339 SUSE bug 869563 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls. Moderate CVE-2013-7446 SUSE bug 1020452 SUSE bug 955654 SUSE bug 955837 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310. Important CVE-2013-7470 SUSE bug 1133087 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402. Moderate CVE-2014-0012 SUSE bug 858239 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line. Low CVE-2014-0019 SUSE bug 860991 SUSE bug 927161 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter. Important CVE-2014-0038 SUSE bug 860993 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. Important CVE-2014-0069 SUSE bug 864025 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. Moderate CVE-2014-0155 SUSE bug 824295 SUSE bug 872540 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. Moderate CVE-2014-0181 SUSE bug 875051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document. Important CVE-2014-0191 SUSE bug 1014873 SUSE bug 1123919 SUSE bug 876652 SUSE bug 877506 SUSE bug 996079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. Moderate CVE-2014-0196 SUSE bug 871252 SUSE bug 875690 SUSE bug 877345 SUSE bug 879878 SUSE bug 933423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call. Moderate CVE-2014-0203 SUSE bug 883526 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image. Moderate CVE-2014-0222 SUSE bug 1072223 SUSE bug 877642 SUSE bug 950367 SUSE bug 964925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read. Moderate CVE-2014-0223 SUSE bug 877645 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00. Important CVE-2014-1569 SUSE bug 910647 SUSE bug 913096 SUSE bug 917597 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. Important CVE-2014-1737 SUSE bug 1115893 SUSE bug 875798 SUSE bug 877345 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. Important CVE-2014-1738 SUSE bug 875798 SUSE bug 877345 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction. Moderate CVE-2014-2039 SUSE bug 862796 SUSE bug 865307 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file. Important CVE-2014-2240 SUSE bug 867620 SUSE bug 916867 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets. Important CVE-2014-2309 SUSE bug 824295 SUSE bug 867531 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions. Important CVE-2014-2672 SUSE bug 871148 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. Moderate CVE-2014-2678 SUSE bug 871561 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. Important CVE-2014-2706 SUSE bug 1115893 SUSE bug 871797 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings. Moderate CVE-2014-3122 SUSE bug 824295 SUSE bug 876102 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced. Moderate CVE-2014-3144 SUSE bug 824295 SUSE bug 877257 SUSE bug 889071 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. Important CVE-2014-3145 SUSE bug 824295 SUSE bug 877257 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. Important CVE-2014-3153 SUSE bug 877775 SUSE bug 880892 SUSE bug 882228 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event. Moderate CVE-2014-3181 SUSE bug 896382 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c. Moderate CVE-2014-3184 SUSE bug 896390 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report. Moderate CVE-2014-3186 SUSE bug 896392 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks." Moderate CVE-2014-3461 SUSE bug 878541 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message. Moderate CVE-2014-3513 SUSE bug 901277 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/. Moderate CVE-2014-3537 SUSE bug 887240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure. Important CVE-2014-3567 SUSE bug 877506 SUSE bug 901277 SUSE bug 905106 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c. Moderate CVE-2014-3568 SUSE bug 901277 SUSE bug 905106 SUSE bug 911399 SUSE bug 986238 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix. Moderate CVE-2014-3569 SUSE bug 911399 SUSE bug 927623 SUSE bug 986238 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c. Moderate CVE-2014-3570 SUSE bug 912296 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 SUSE bug 944456 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c. Moderate CVE-2014-3571 SUSE bug 912294 SUSE bug 915848 SUSE bug 927623 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message. Moderate CVE-2014-3572 SUSE bug 912015 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication. Moderate CVE-2014-3591 SUSE bug 920057 SUSE bug 949135 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages. Moderate CVE-2014-3601 SUSE bug 892782 SUSE bug 902675 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. Moderate CVE-2014-3610 SUSE bug 899192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes." Important CVE-2014-3618 SUSE bug 1068648 SUSE bug 894999 SUSE bug 898303 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call. Moderate CVE-2014-3636 SUSE bug 896453 SUSE bug 904017 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor. Moderate CVE-2014-3637 SUSE bug 896453 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections. Moderate CVE-2014-3639 SUSE bug 896453 SUSE bug 903055 SUSE bug 903057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket. CVE-2014-3640 SUSE bug 897654 SUSE bug 965112 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. Moderate CVE-2014-3646 SUSE bug 899192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack. Moderate CVE-2014-3660 SUSE bug 1123919 SUSE bug 901546 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr. Low CVE-2014-3672 SUSE bug 981264 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Moderate CVE-2014-3673 SUSE bug 1115893 SUSE bug 902346 SUSE bug 902349 SUSE bug 904899 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet. Important CVE-2014-3675 SUSE bug 889332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option." Important CVE-2014-3676 SUSE bug 889332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption. Important CVE-2014-3677 SUSE bug 889332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame. Moderate CVE-2014-3686 SUSE bug 1063667 SUSE bug 900611 SUSE bug 915323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. Important CVE-2014-3687 SUSE bug 1115893 SUSE bug 902349 SUSE bug 904899 SUSE bug 909208 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c. Moderate CVE-2014-3688 SUSE bug 902351 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU. Moderate CVE-2014-3690 SUSE bug 902232 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file. Moderate CVE-2014-3710 SUSE bug 902367 SUSE bug 910252 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. Moderate CVE-2014-3917 SUSE bug 880484 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream. Moderate CVE-2014-4040 SUSE bug 883174 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. Important CVE-2014-4508 SUSE bug 883724 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run. Important CVE-2014-4607 SUSE bug 883947 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype." Moderate CVE-2014-4608 SUSE bug 883948 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator. Moderate CVE-2014-4650 SUSE bug 856835 SUSE bug 856836 SUSE bug 863741 SUSE bug 885882 SUSE bug 898572 SUSE bug 912739 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. Moderate CVE-2014-4667 SUSE bug 885422 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. Moderate CVE-2014-4943 SUSE bug 887082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537. Moderate CVE-2014-5029 SUSE bug 887240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py. Moderate CVE-2014-5030 SUSE bug 887240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors. Moderate CVE-2014-5031 SUSE bug 887240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions." Moderate CVE-2014-5033 SUSE bug 864716 SUSE bug 912121 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program. Moderate CVE-2014-5045 SUSE bug 889060 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction. Important CVE-2014-5077 SUSE bug 889173 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. Moderate CVE-2014-5277 SUSE bug 904165 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access. Moderate CVE-2014-5351 SUSE bug 897874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. Moderate CVE-2014-5352 SUSE bug 1005509 SUSE bug 770172 SUSE bug 912002 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy. Low CVE-2014-5353 SUSE bug 910457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. Low CVE-2014-5354 SUSE bug 910458 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c. Moderate CVE-2014-5355 SUSE bug 770172 SUSE bug 918595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. Moderate CVE-2014-5471 SUSE bug 892490 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. Moderate CVE-2014-5472 SUSE bug 892490 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later. Low CVE-2014-6272 SUSE bug 897243 SUSE bug 943011 SUSE bug 947373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation. Moderate CVE-2014-6407 SUSE bug 907012 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image. Moderate CVE-2014-6408 SUSE bug 907014 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode. Moderate CVE-2014-6410 SUSE bug 896689 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request. Moderate CVE-2014-7202 SUSE bug 898917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors. Moderate CVE-2014-7203 SUSE bug 898917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations. Moderate CVE-2014-7283 SUSE bug 899480 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value. Moderate CVE-2014-7815 SUSE bug 902737 SUSE bug 962627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))". Moderate CVE-2014-7817 SUSE bug 906371 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem. Moderate CVE-2014-7822 SUSE bug 1115893 SUSE bug 915322 SUSE bug 915517 SUSE bug 939240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag. Moderate CVE-2014-7823 SUSE bug 904176 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1. Moderate CVE-2014-7824 SUSE bug 904017 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data. Moderate CVE-2014-7840 SUSE bug 905097 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313. Moderate CVE-2014-7842 SUSE bug 905312 SUSE bug 907822 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call. Moderate CVE-2014-7970 SUSE bug 900644 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call. Moderate CVE-2014-7975 SUSE bug 900392 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320. Moderate CVE-2014-8106 SUSE bug 1023004 SUSE bug 1178658 SUSE bug 907805 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities. Moderate CVE-2014-8116 SUSE bug 910252 SUSE bug 910253 SUSE bug 917152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors. Moderate CVE-2014-8117 SUSE bug 910252 SUSE bug 910253 SUSE bug 917152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions. Important CVE-2014-8119 SUSE bug 925225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset. Moderate CVE-2014-8121 SUSE bug 1123874 SUSE bug 918187 SUSE bug 945779 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool. Critical CVE-2014-8127 SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 942690 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image. Critical CVE-2014-8128 SUSE bug 1007276 SUSE bug 1017690 SUSE bug 1040322 SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 942690 SUSE bug 960341 SUSE bug 969783 SUSE bug 974621 SUSE bug 983436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c. Critical CVE-2014-8129 SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 942690 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither. Critical CVE-2014-8130 SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 942690 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access. Low CVE-2014-8131 SUSE bug 909274 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet. Moderate CVE-2014-8132 SUSE bug 910790 SUSE bug 928323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value. Low CVE-2014-8134 SUSE bug 907818 SUSE bug 909077 SUSE bug 909078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation. Important CVE-2014-8143 SUSE bug 914279 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges. Important CVE-2014-8148 SUSE bug 912023 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL. Moderate CVE-2014-8150 SUSE bug 911363 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers. Important CVE-2014-8160 SUSE bug 857643 SUSE bug 913059 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands. Important CVE-2014-8178 SUSE bug 949660 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation. Important CVE-2014-8179 SUSE bug 949660 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack. Low CVE-2014-8242 SUSE bug 900914 SUSE bug 922710 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c. Moderate CVE-2014-8275 SUSE bug 912018 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. Important CVE-2014-8369 SUSE bug 892782 SUSE bug 902675 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application. Moderate CVE-2014-8559 SUSE bug 903640 SUSE bug 915517 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs. Moderate CVE-2014-8564 SUSE bug 904603 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets. Important CVE-2014-8709 SUSE bug 904700 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats. Moderate CVE-2014-8964 SUSE bug 906574 SUSE bug 924960 SUSE bug 933288 SUSE bug 936408 SUSE bug 958373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow. Important CVE-2014-9087 SUSE bug 907074 SUSE bug 926826 SUSE bug 996084 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker. Moderate CVE-2014-9092 SUSE bug 906761 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive. Moderate CVE-2014-9112 SUSE bug 907456 SUSE bug 913479 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. Important CVE-2014-9114 SUSE bug 907434 SUSE bug 908742 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile. Critical CVE-2014-9356 SUSE bug 909712 SUSE bug 909747 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction. Critical CVE-2014-9357 SUSE bug 909710 SUSE bug 909747 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications." Moderate CVE-2014-9358 SUSE bug 909709 SUSE bug 909747 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process. Important CVE-2014-9402 SUSE bug 910599 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. Low CVE-2014-9419 SUSE bug 911326 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image. Low CVE-2014-9420 SUSE bug 906545 SUSE bug 911325 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind. Moderate CVE-2014-9421 SUSE bug 1005509 SUSE bug 770172 SUSE bug 912002 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal. Moderate CVE-2014-9422 SUSE bug 1005509 SUSE bug 770172 SUSE bug 912002 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field. Moderate CVE-2014-9423 SUSE bug 1005509 SUSE bug 912002 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program. Moderate CVE-2014-9447 SUSE bug 911662 SUSE bug 912408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read. Moderate CVE-2014-9488 SUSE bug 921719 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path. Moderate CVE-2014-9512 SUSE bug 915410 SUSE bug 960191 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key. Important CVE-2014-9529 SUSE bug 1072204 SUSE bug 1115893 SUSE bug 912202 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop. Moderate CVE-2014-9556 SUSE bug 912214 SUSE bug 919283 SUSE bug 934533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image. Moderate CVE-2014-9584 SUSE bug 912654 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. Important CVE-2014-9585 SUSE bug 912705 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif. Moderate CVE-2014-9655 SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 916927 SUSE bug 969783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font. Moderate CVE-2014-9656 SUSE bug 916847 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font. Moderate CVE-2014-9657 SUSE bug 916856 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font. Moderate CVE-2014-9658 SUSE bug 916857 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240. Moderate CVE-2014-9659 SUSE bug 916867 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font. Moderate CVE-2014-9660 SUSE bug 916858 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font. Moderate CVE-2014-9661 SUSE bug 916859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font. Moderate CVE-2014-9662 SUSE bug 916860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table. Moderate CVE-2014-9663 SUSE bug 916865 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c. Moderate CVE-2014-9664 SUSE bug 916864 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file. Moderate CVE-2014-9665 SUSE bug 916863 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap. Moderate CVE-2014-9666 SUSE bug 916862 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table. Moderate CVE-2014-9667 SUSE bug 916861 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file. Moderate CVE-2014-9668 SUSE bug 916868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table. Moderate CVE-2014-9669 SUSE bug 916870 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row. Moderate CVE-2014-9670 SUSE bug 916871 SUSE bug 933247 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented. Moderate CVE-2014-9671 SUSE bug 916872 SUSE bug 933247 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file. Moderate CVE-2014-9672 SUSE bug 916873 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. Moderate CVE-2014-9673 SUSE bug 916874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. Moderate CVE-2014-9674 SUSE bug 916879 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font. Moderate CVE-2014-9675 SUSE bug 916881 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives. Low CVE-2014-9680 SUSE bug 917806 SUSE bug 919737 SUSE bug 921999 SUSE bug 953359 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit. Moderate CVE-2014-9710 SUSE bug 923908 SUSE bug 939260 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace. Low CVE-2014-9717 SUSE bug 928547 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header. Moderate CVE-2014-9721 SUSE bug 931978 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c. Low CVE-2014-9728 SUSE bug 911325 SUSE bug 933904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image. Low CVE-2014-9729 SUSE bug 911325 SUSE bug 933904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image. Low CVE-2014-9730 SUSE bug 911325 SUSE bug 933904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c. Low CVE-2014-9731 SUSE bug 911325 SUSE bug 933896 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function. Critical CVE-2014-9761 SUSE bug 1123874 SUSE bug 962738 SUSE bug 986086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values. Moderate CVE-2014-9766 SUSE bug 968090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call. Moderate CVE-2014-9904 SUSE bug 986811 SUSE bug 986941 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets. Moderate CVE-2014-9914 SUSE bug 1023997 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c. Moderate CVE-2014-9922 SUSE bug 1032340 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations. Critical CVE-2015-0204 SUSE bug 912014 SUSE bug 920482 SUSE bug 920484 SUSE bug 927591 SUSE bug 927623 SUSE bug 936787 SUSE bug 952088 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support. Moderate CVE-2015-0205 SUSE bug 912293 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection. Moderate CVE-2015-0206 SUSE bug 912292 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import. Critical CVE-2015-0209 SUSE bug 919648 SUSE bug 936586 SUSE bug 937891 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. Low CVE-2015-0236 SUSE bug 914693 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction. Moderate CVE-2015-0239 SUSE bug 987709 SUSE bug 994618 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c. Critical CVE-2015-0240 SUSE bug 917376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. Low CVE-2015-0245 SUSE bug 1003898 SUSE bug 916343 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image. Moderate CVE-2015-0247 SUSE bug 1123790 SUSE bug 915402 SUSE bug 918346 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access. Important CVE-2015-0274 SUSE bug 919655 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request. Moderate CVE-2015-0275 SUSE bug 919032 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature. Critical CVE-2015-0286 SUSE bug 919648 SUSE bug 922496 SUSE bug 936586 SUSE bug 937891 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse. Critical CVE-2015-0287 SUSE bug 919648 SUSE bug 922499 SUSE bug 936586 SUSE bug 937891 SUSE bug 968888 SUSE bug 991722 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key. Critical CVE-2015-0288 SUSE bug 919648 SUSE bug 920236 SUSE bug 936586 SUSE bug 937891 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. Critical CVE-2015-0289 SUSE bug 919648 SUSE bug 922500 SUSE bug 936586 SUSE bug 937891 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message. Critical CVE-2015-0293 SUSE bug 919648 SUSE bug 922488 SUSE bug 936586 SUSE bug 968044 SUSE bug 968051 SUSE bug 968053 SUSE bug 986238 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack." Moderate CVE-2015-0837 SUSE bug 920057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc). Low CVE-2015-0840 SUSE bug 926749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code. Critical CVE-2015-1158 SUSE bug 924208 SUSE bug 976653 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/. Critical CVE-2015-1159 SUSE bug 924208 SUSE bug 976653 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. Moderate CVE-2015-1283 SUSE bug 1034050 SUSE bug 939077 SUSE bug 979441 SUSE bug 980391 SUSE bug 983985 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times. Low CVE-2015-1339 SUSE bug 969356 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option. Low CVE-2015-1345 SUSE bug 914695 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash). Moderate CVE-2015-1379 SUSE bug 922903 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function. Moderate CVE-2015-1420 SUSE bug 915517 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call. Moderate CVE-2015-1472 SUSE bug 916222 SUSE bug 920341 SUSE bug 922243 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call. Moderate CVE-2015-1473 SUSE bug 916222 SUSE bug 920341 SUSE bug 922243 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request. Moderate CVE-2015-1545 SUSE bug 846389 SUSE bug 916897 SUSE bug 916914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control. Moderate CVE-2015-1546 SUSE bug 916914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif. Moderate CVE-2015-1547 SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247. Low CVE-2015-1572 SUSE bug 1123790 SUSE bug 915402 SUSE bug 918346 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c. Important CVE-2015-1593 SUSE bug 1044934 SUSE bug 917839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section. Moderate CVE-2015-1779 SUSE bug 924018 SUSE bug 962632 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer. Moderate CVE-2015-1781 SUSE bug 1123874 SUSE bug 927080 SUSE bug 979109 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet. Moderate CVE-2015-1782 SUSE bug 921070 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication. Moderate CVE-2015-1788 SUSE bug 934487 SUSE bug 934666 SUSE bug 936586 SUSE bug 937891 SUSE bug 938432 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback. Important CVE-2015-1789 SUSE bug 934489 SUSE bug 934666 SUSE bug 936586 SUSE bug 937891 SUSE bug 938432 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data. Moderate CVE-2015-1790 SUSE bug 934491 SUSE bug 934666 SUSE bug 936586 SUSE bug 938432 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier. Moderate CVE-2015-1791 SUSE bug 933911 SUSE bug 934666 SUSE bug 986238 SUSE bug 989464 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function. Moderate CVE-2015-1792 SUSE bug 934493 SUSE bug 934666 SUSE bug 937891 SUSE bug 986238 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate. Moderate CVE-2015-1793 SUSE bug 936746 SUSE bug 937637 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message. Low CVE-2015-1794 SUSE bug 957984 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." Important CVE-2015-1805 SUSE bug 917839 SUSE bug 933429 SUSE bug 939270 SUSE bug 964730 SUSE bug 964732 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack. Moderate CVE-2015-1819 SUSE bug 1123919 SUSE bug 928193 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries. Low CVE-2015-1863 SUSE bug 915323 SUSE bug 927558 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Important CVE-2015-20107 SUSE bug 1198511 SUSE bug 1200507 SUSE bug 1201777 SUSE bug 1201791 SUSE bug 1205068 SUSE bug 1208337 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read. Low CVE-2015-2059 SUSE bug 1173590 SUSE bug 919214 SUSE bug 923241 SUSE bug 937096 SUSE bug 937097 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. Low CVE-2015-2296 SUSE bug 922448 SUSE bug 926396 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier. Moderate CVE-2015-2325 SUSE bug 924960 SUSE bug 933288 SUSE bug 936408 SUSE bug 958373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/". Moderate CVE-2015-2326 SUSE bug 924960 SUSE bug 924961 SUSE bug 933288 SUSE bug 936408 SUSE bug 958373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c. Moderate CVE-2015-2694 SUSE bug 928978 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call. Important CVE-2015-2695 SUSE bug 770172 SUSE bug 952188 SUSE bug 969771 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call. Important CVE-2015-2696 SUSE bug 770172 SUSE bug 952189 SUSE bug 954204 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request. Moderate CVE-2015-2697 SUSE bug 770172 SUSE bug 952190 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696. Important CVE-2015-2698 SUSE bug 770172 SUSE bug 954204 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue. Critical CVE-2015-2721 SUSE bug 935979 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors. Critical CVE-2015-2806 SUSE bug 924828 SUSE bug 929414 SUSE bug 961491 SUSE bug 969208 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922. Moderate CVE-2015-2924 SUSE bug 926223 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015. Moderate CVE-2015-3143 SUSE bug 927556 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80." Important CVE-2015-3144 SUSE bug 927608 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character. Important CVE-2015-3145 SUSE bug 927607 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet. Moderate CVE-2015-3146 SUSE bug 928323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request. Moderate CVE-2015-3148 SUSE bug 1092962 SUSE bug 927746 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents. Moderate CVE-2015-3153 SUSE bug 928533 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite. Moderate CVE-2015-3193 SUSE bug 1022086 SUSE bug 1066242 SUSE bug 1071906 SUSE bug 957814 SUSE bug 960151 SUSE bug 990370 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter. Moderate CVE-2015-3194 SUSE bug 957812 SUSE bug 957815 SUSE bug 958768 SUSE bug 976341 SUSE bug 990370 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application. Moderate CVE-2015-3195 SUSE bug 923755 SUSE bug 957812 SUSE bug 957815 SUSE bug 958768 SUSE bug 963977 SUSE bug 986238 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message. Moderate CVE-2015-3196 SUSE bug 957813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions. Low CVE-2015-3197 SUSE bug 963410 SUSE bug 963415 SUSE bug 968044 SUSE bug 968046 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature. Moderate CVE-2015-3202 SUSE bug 931452 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set. Important CVE-2015-3209 SUSE bug 932267 SUSE bug 932770 SUSE bug 932823 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. Moderate CVE-2015-3217 SUSE bug 933878 SUSE bug 958373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path. Moderate CVE-2015-3218 SUSE bug 933922 SUSE bug 943816 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service (infinite loop) via crafted packets. Important CVE-2015-3223 SUSE bug 958581 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors. Moderate CVE-2015-3236 SUSE bug 934501 SUSE bug 951391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values. Moderate CVE-2015-3237 SUSE bug 934502 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password. Moderate CVE-2015-3238 SUSE bug 1123794 SUSE bug 934920 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes. Low CVE-2015-3239 SUSE bug 1122012 SUSE bug 936786 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors. Moderate CVE-2015-3247 SUSE bug 944460 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions. Moderate CVE-2015-3255 SUSE bug 939246 SUSE bug 943816 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation." Moderate CVE-2015-3256 SUSE bug 943816 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument. Moderate CVE-2015-3259 SUSE bug 935634 SUSE bug 936281 SUSE bug 937018 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero. Moderate CVE-2015-3288 SUSE bug 1115893 SUSE bug 979021 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window. Important CVE-2015-3290 SUSE bug 937969 SUSE bug 937970 SUSE bug 938706 SUSE bug 939207 SUSE bug 939269 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request. Moderate CVE-2015-3294 SUSE bug 923144 SUSE bug 928867 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. Moderate CVE-2015-3331 SUSE bug 1115893 SUSE bug 927257 SUSE bug 931231 SUSE bug 939262 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. Low CVE-2015-3340 SUSE bug 927967 SUSE bug 929339 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement. Moderate CVE-2015-3414 SUSE bug 1085790 SUSE bug 1190372 SUSE bug 1193078 SUSE bug 928700 SUSE bug 928701 SUSE bug 928702 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement. Moderate CVE-2015-3415 SUSE bug 1190372 SUSE bug 928700 SUSE bug 928701 SUSE bug 928702 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement. Moderate CVE-2015-3416 SUSE bug 1190372 SUSE bug 928700 SUSE bug 928701 SUSE bug 928702 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. Moderate CVE-2015-3456 SUSE bug 929339 SUSE bug 932770 SUSE bug 935900 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate. Low CVE-2015-3622 SUSE bug 929414 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image. Low CVE-2015-3627 SUSE bug 930235 SUSE bug 945060 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container. Important CVE-2015-3629 SUSE bug 930235 SUSE bug 945060 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image. Important CVE-2015-3630 SUSE bug 930235 SUSE bug 945060 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc. Low CVE-2015-3631 SUSE bug 930235 SUSE bug 945060 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. Moderate CVE-2015-3636 SUSE bug 929525 SUSE bug 939277 SUSE bug 994624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. Important CVE-2015-4000 SUSE bug 1074631 SUSE bug 1211968 SUSE bug 931600 SUSE bug 931698 SUSE bug 931723 SUSE bug 931845 SUSE bug 932026 SUSE bug 932483 SUSE bug 934789 SUSE bug 935033 SUSE bug 935540 SUSE bug 935979 SUSE bug 937202 SUSE bug 937766 SUSE bug 938248 SUSE bug 938432 SUSE bug 938895 SUSE bug 938905 SUSE bug 938906 SUSE bug 938913 SUSE bug 938945 SUSE bug 943664 SUSE bug 944729 SUSE bug 945582 SUSE bug 955589 SUSE bug 980406 SUSE bug 990592 SUSE bug 994144 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program. Low CVE-2015-4037 SUSE bug 932267 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings. Critical CVE-2015-4041 SUSE bug 928749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings. Critical CVE-2015-4042 SUSE bug 1167100 SUSE bug 928749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields. Moderate CVE-2015-4103 SUSE bug 931625 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors. Important CVE-2015-4104 SUSE bug 931626 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations. Moderate CVE-2015-4105 SUSE bug 931627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors. Moderate CVE-2015-4106 SUSE bug 931628 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow. Moderate CVE-2015-4141 SUSE bug 915323 SUSE bug 930077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read. Moderate CVE-2015-4142 SUSE bug 915323 SUSE bug 930078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload. Moderate CVE-2015-4143 SUSE bug 930079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message. Moderate CVE-2015-4144 SUSE bug 930079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message. Moderate CVE-2015-4145 SUSE bug 930079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message. Moderate CVE-2015-4146 SUSE bug 930079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem. Important CVE-2015-4167 SUSE bug 917839 SUSE bug 933907 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling. Moderate CVE-2015-4491 SUSE bug 940806 SUSE bug 942801 SUSE bug 948790 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value. Moderate CVE-2015-4625 SUSE bug 935119 SUSE bug 943816 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow. Moderate CVE-2015-4645 SUSE bug 935380 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input. Moderate CVE-2015-4646 SUSE bug 935380 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands. Important CVE-2015-5154 SUSE bug 938344 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets. Moderate CVE-2015-5156 SUSE bug 1091815 SUSE bug 1123903 SUSE bug 940776 SUSE bug 945048 SUSE bug 951638 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI. Important CVE-2015-5157 SUSE bug 1072204 SUSE bug 1115893 SUSE bug 937969 SUSE bug 937970 SUSE bug 938706 SUSE bug 939207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash). Important CVE-2015-5180 SUSE bug 1123874 SUSE bug 1215582 SUSE bug 941234 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Audit before 2.4.4 in Linux does not sanitize escape characters in filenames. Moderate CVE-2015-5186 SUSE bug 941922 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Moderate CVE-2015-5191 SUSE bug 1007600 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable. Low CVE-2015-5218 SUSE bug 949754 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface. Moderate CVE-2015-5225 SUSE bug 942845 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop. Moderate CVE-2015-5239 SUSE bug 944463 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name. Moderate CVE-2015-5245 SUSE bug 945206 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool. Low CVE-2015-5247 SUSE bug 945645 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share. Moderate CVE-2015-5252 SUSE bug 958582 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter. Important CVE-2015-5260 SUSE bug 944787 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation. Important CVE-2015-5261 SUSE bug 948976 SUSE bug 982386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets. Moderate CVE-2015-5278 SUSE bug 945989 SUSE bug 964947 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets. Important CVE-2015-5279 SUSE bug 945987 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c. Moderate CVE-2015-5296 SUSE bug 1058622 SUSE bug 958584 SUSE bug 973031 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code. Moderate CVE-2015-5297 SUSE bug 1117000 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory. Low CVE-2015-5299 SUSE bug 958583 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c. Moderate CVE-2015-5307 SUSE bug 953527 SUSE bug 954018 SUSE bug 954404 SUSE bug 954405 SUSE bug 962977 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response. Low CVE-2015-5310 SUSE bug 952254 SUSE bug 953115 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660. Important CVE-2015-5312 SUSE bug 1123919 SUSE bug 957105 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name. Low CVE-2015-5313 SUSE bug 953110 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message. Moderate CVE-2015-5315 SUSE bug 953115 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange. Moderate CVE-2015-5316 SUSE bug 953115 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value. Low CVE-2015-5330 SUSE bug 958581 SUSE bug 958586 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors. Important CVE-2015-5370 SUSE bug 936862 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack. Important CVE-2015-5738 SUSE bug 944456 SUSE bug 944835 SUSE bug 944836 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message. Low CVE-2015-5745 SUSE bug 940929 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate. Moderate CVE-2015-6251 SUSE bug 941794 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet. Moderate CVE-2015-6496 SUSE bug 942149 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions. Low CVE-2015-6525 SUSE bug 897243 SUSE bug 943011 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors. Low CVE-2015-6815 SUSE bug 944697 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash. Moderate CVE-2015-6855 SUSE bug 945404 SUSE bug 965156 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. Important CVE-2015-6908 SUSE bug 945582 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. Moderate CVE-2015-6937 SUSE bug 1115893 SUSE bug 923755 SUSE bug 945825 SUSE bug 952384 SUSE bug 953052 SUSE bug 963994 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue. Important CVE-2015-7181 SUSE bug 952810 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data. Important CVE-2015-7182 SUSE bug 952810 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors. Important CVE-2015-7183 SUSE bug 952810 SUSE bug 962977 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code. Moderate CVE-2015-7236 SUSE bug 940191 SUSE bug 946204 SUSE bug 979097 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface. Moderate CVE-2015-7295 SUSE bug 947159 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image. Low CVE-2015-7311 SUSE bug 947165 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors. Moderate CVE-2015-7497 SUSE bug 1123919 SUSE bug 957106 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure. Moderate CVE-2015-7498 SUSE bug 1123919 SUSE bug 957107 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors. Moderate CVE-2015-7499 SUSE bug 1123919 SUSE bug 957109 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags. Moderate CVE-2015-7500 SUSE bug 1123919 SUSE bug 957110 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode. Important CVE-2015-7504 SUSE bug 956411 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Important CVE-2015-7510 SUSE bug 956712 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations. Moderate CVE-2015-7511 SUSE bug 965902 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet. Important CVE-2015-7512 SUSE bug 957162 SUSE bug 962360 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions. Moderate CVE-2015-7513 SUSE bug 1020452 SUSE bug 960689 SUSE bug 987709 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. Important CVE-2015-7547 SUSE bug 1077097 SUSE bug 847227 SUSE bug 961721 SUSE bug 967023 SUSE bug 967061 SUSE bug 967072 SUSE bug 967496 SUSE bug 969216 SUSE bug 969241 SUSE bug 969591 SUSE bug 986086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method. Low CVE-2015-7549 SUSE bug 958917 SUSE bug 958918 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file. Moderate CVE-2015-7552 SUSE bug 958963 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image. Important CVE-2015-7554 SUSE bug 1007276 SUSE bug 1017690 SUSE bug 1040322 SUSE bug 960341 SUSE bug 974621 SUSE bug 983436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content. Moderate CVE-2015-7560 SUSE bug 968222 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision. Moderate CVE-2015-7575 SUSE bug 959888 SUSE bug 960402 SUSE bug 960996 SUSE bug 961280 SUSE bug 961281 SUSE bug 961282 SUSE bug 961283 SUSE bug 961284 SUSE bug 961290 SUSE bug 961357 SUSE bug 962743 SUSE bug 963937 SUSE bug 967521 SUSE bug 981087 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c. Moderate CVE-2015-7613 SUSE bug 923755 SUSE bug 948536 SUSE bug 948701 SUSE bug 963994 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file. Moderate CVE-2015-7673 SUSE bug 948790 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow. Moderate CVE-2015-7674 SUSE bug 948791 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call. Low CVE-2015-7799 SUSE bug 1020452 SUSE bug 1052256 SUSE bug 949936 SUSE bug 951638 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping. Important CVE-2015-7835 SUSE bug 940929 SUSE bug 947159 SUSE bug 950367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application. Low CVE-2015-7884 SUSE bug 1126909 SUSE bug 951626 SUSE bug 951627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application. Low CVE-2015-7885 SUSE bug 1126909 SUSE bug 951626 SUSE bug 951627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities. Low CVE-2015-7941 SUSE bug 1123919 SUSE bug 951734 SUSE bug 951735 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941. Low CVE-2015-7942 SUSE bug 1123919 SUSE bug 951735 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall. Moderate CVE-2015-7969 SUSE bug 950703 SUSE bug 950705 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand. Moderate CVE-2015-7970 SUSE bug 950704 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c. Low CVE-2015-7971 SUSE bug 950706 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure." Low CVE-2015-7972 SUSE bug 950704 SUSE bug 951845 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read. Moderate CVE-2015-7981 SUSE bug 952051 SUSE bug 960402 SUSE bug 963937 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937. Low CVE-2015-7990 SUSE bug 945825 SUSE bug 952384 SUSE bug 953052 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue. Low CVE-2015-7995 SUSE bug 1123130 SUSE bug 952474 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data. Low CVE-2015-8035 SUSE bug 1088279 SUSE bug 1105166 SUSE bug 954429 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read. Moderate CVE-2015-8041 SUSE bug 937419 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c. Moderate CVE-2015-8104 SUSE bug 1215748 SUSE bug 953527 SUSE bug 954018 SUSE bug 954404 SUSE bug 954405 SUSE bug 962977 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. Moderate CVE-2015-8126 SUSE bug 954980 SUSE bug 958198 SUSE bug 960402 SUSE bug 962743 SUSE bug 963937 SUSE bug 969333 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. Moderate CVE-2015-8242 SUSE bug 1123919 SUSE bug 956021 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function. Moderate CVE-2015-8324 SUSE bug 956707 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable. Moderate CVE-2015-8325 SUSE bug 1138392 SUSE bug 975865 SUSE bug 996040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown. Moderate CVE-2015-8339 SUSE bug 956408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling. Moderate CVE-2015-8340 SUSE bug 956408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains. Moderate CVE-2015-8341 SUSE bug 956409 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list. Moderate CVE-2015-8345 SUSE bug 956829 SUSE bug 956832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error. Moderate CVE-2015-8370 SUSE bug 956631 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535. Important CVE-2015-8467 SUSE bug 958585 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126. Moderate CVE-2015-8472 SUSE bug 954980 SUSE bug 958198 SUSE bug 960402 SUSE bug 963937 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client. Moderate CVE-2015-8504 SUSE bug 958491 SUSE bug 958493 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c. Important CVE-2015-8539 SUSE bug 1115893 SUSE bug 781018 SUSE bug 958463 SUSE bug 958601 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read. Low CVE-2015-8540 SUSE bug 1149680 SUSE bug 958791 SUSE bug 963937 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. Moderate CVE-2015-8543 SUSE bug 1020452 SUSE bug 1052256 SUSE bug 1115893 SUSE bug 923755 SUSE bug 958886 SUSE bug 963994 SUSE bug 969522 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability. Moderate CVE-2015-8550 SUSE bug 1020452 SUSE bug 1052256 SUSE bug 957988 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks." Moderate CVE-2015-8551 SUSE bug 1020452 SUSE bug 957990 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks." Moderate CVE-2015-8552 SUSE bug 1020452 SUSE bug 957990 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777. Moderate CVE-2015-8553 SUSE bug 903967 SUSE bug 957990 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path." Moderate CVE-2015-8554 SUSE bug 958007 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors. Moderate CVE-2015-8555 SUSE bug 958009 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list. Moderate CVE-2015-8558 SUSE bug 959005 SUSE bug 959006 SUSE bug 976109 SUSE bug 976111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption). Low CVE-2015-8567 SUSE bug 959386 SUSE bug 959387 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly. Low CVE-2015-8568 SUSE bug 959386 SUSE bug 959387 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command. Moderate CVE-2015-8613 SUSE bug 961358 SUSE bug 961556 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ). Low CVE-2015-8615 SUSE bug 960093 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash). Moderate CVE-2015-8619 SUSE bug 960334 SUSE bug 965269 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string. Low CVE-2015-8629 SUSE bug 770172 SUSE bug 963968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name. Low CVE-2015-8630 SUSE bug 963964 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name. Moderate CVE-2015-8631 SUSE bug 963975 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application. Important CVE-2015-8660 SUSE bug 923755 SUSE bug 960281 SUSE bug 960329 SUSE bug 963994 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image. Low CVE-2015-8665 SUSE bug 1156749 SUSE bug 1156754 SUSE bug 1200195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image. Moderate CVE-2015-8668 SUSE bug 1014461 SUSE bug 960589 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image. Low CVE-2015-8683 SUSE bug 1156749 SUSE bug 1156754 SUSE bug 1200195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes. Moderate CVE-2015-8743 SUSE bug 960725 SUSE bug 960726 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS. Low CVE-2015-8744 SUSE bug 960835 SUSE bug 960836 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS. Low CVE-2015-8745 SUSE bug 960707 SUSE bug 960708 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value. Low CVE-2015-8776 SUSE bug 1123874 SUSE bug 962736 SUSE bug 986086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable. Low CVE-2015-8777 SUSE bug 1123874 SUSE bug 950944 SUSE bug 962735 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access. Low CVE-2015-8778 SUSE bug 1123874 SUSE bug 962737 SUSE bug 986086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name. Important CVE-2015-8779 SUSE bug 1123874 SUSE bug 962739 SUSE bug 965453 SUSE bug 986086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782. Moderate CVE-2015-8781 SUSE bug 964213 SUSE bug 964225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781. Moderate CVE-2015-8782 SUSE bug 964213 SUSE bug 964225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image. Moderate CVE-2015-8783 SUSE bug 964213 SUSE bug 964225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov. Low CVE-2015-8785 SUSE bug 1020452 SUSE bug 963765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805. Moderate CVE-2015-8803 SUSE bug 964845 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors. Moderate CVE-2015-8804 SUSE bug 964847 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803. Moderate CVE-2015-8805 SUSE bug 964849 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device. Moderate CVE-2015-8816 SUSE bug 1020452 SUSE bug 968010 SUSE bug 979064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression. Important CVE-2015-8830 SUSE bug 969354 SUSE bug 969355 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling. Moderate CVE-2015-8839 SUSE bug 972174 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. Moderate CVE-2015-8844 SUSE bug 975531 SUSE bug 975533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. Moderate CVE-2015-8845 SUSE bug 975531 SUSE bug 975533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow. Low CVE-2015-8863 SUSE bug 1014176 SUSE bug 976992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally. Moderate CVE-2015-8899 SUSE bug 983273 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read. Moderate CVE-2015-8948 SUSE bug 1014473 SUSE bug 1173590 SUSE bug 1190777 SUSE bug 990189 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call. Low CVE-2015-8950 SUSE bug 1003931 SUSE bug 1004045 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/overlayfs/copy_up.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service (dentry reference leak) via filesystem operations on a large file in a lower overlayfs layer. Low CVE-2015-8953 SUSE bug 995763 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs. Important CVE-2015-8955 SUSE bug 1003931 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call. Moderate CVE-2015-8962 SUSE bug 1010501 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation. Moderate CVE-2015-8963 SUSE bug 1010502 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by reading a tty data structure. Moderate CVE-2015-8964 SUSE bug 1010507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c. Moderate CVE-2015-8970 SUSE bug 1008374 SUSE bug 1008850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing. Moderate CVE-2015-8985 SUSE bug 1193625 SUSE bug 920169 SUSE bug 920338 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046. Moderate CVE-2015-9016 SUSE bug 1081683 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs. Low CVE-2015-9019 SUSE bug 1123130 SUSE bug 934119 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23. Critical CVE-2015-9289 SUSE bug 1143179 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again. Low CVE-2015-9290 SUSE bug 1143564 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. Moderate CVE-2015-9381 SUSE bug 1149384 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. Moderate CVE-2015-9382 SUSE bug 1149395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c. Moderate CVE-2015-9383 SUSE bug 1149397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file. Important CVE-2016-0701 SUSE bug 1071906 SUSE bug 1176331 SUSE bug 1195379 SUSE bug 963410 SUSE bug 963413 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack. Important CVE-2016-0702 SUSE bug 1007806 SUSE bug 968044 SUSE bug 968050 SUSE bug 971238 SUSE bug 990370 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key. Critical CVE-2016-0705 SUSE bug 968044 SUSE bug 968047 SUSE bug 971238 SUSE bug 976341 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Moderate CVE-2016-0718 SUSE bug 979441 SUSE bug 991809 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow. Important CVE-2016-0749 SUSE bug 982385 SUSE bug 982386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015. Moderate CVE-2016-0755 SUSE bug 962983 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes. Low CVE-2016-0764 SUSE bug 974072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record. Moderate CVE-2016-0771 SUSE bug 968223 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." Moderate CVE-2016-0772 SUSE bug 984751 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key. Critical CVE-2016-0777 SUSE bug 961642 SUSE bug 996040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings. Important CVE-2016-0778 SUSE bug 961645 SUSE bug 996040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug." Moderate CVE-2016-0787 SUSE bug 1149968 SUSE bug 967026 SUSE bug 968174 SUSE bug 974691 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c. Important CVE-2016-0797 SUSE bug 968044 SUSE bug 968048 SUSE bug 990370 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c. Important CVE-2016-0798 SUSE bug 968044 SUSE bug 968265 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack. Moderate CVE-2016-0800 SUSE bug 1106871 SUSE bug 961377 SUSE bug 968044 SUSE bug 968046 SUSE bug 968888 SUSE bug 969591 SUSE bug 979060 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636. Low CVE-2016-0821 SUSE bug 987709 SUSE bug 994624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721. Moderate CVE-2016-0823 SUSE bug 987709 SUSE bug 994759 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests. Moderate CVE-2016-1000110 SUSE bug 988484 SUSE bug 989523 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket. Moderate CVE-2016-10009 SUSE bug 1016336 SUSE bug 1016366 SUSE bug 1016370 SUSE bug 1026634 SUSE bug 1138392 SUSE bug 1213504 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c. Important CVE-2016-10010 SUSE bug 1016336 SUSE bug 1016368 SUSE bug 1021751 SUSE bug 1196721 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process. Low CVE-2016-10011 SUSE bug 1016336 SUSE bug 1016369 SUSE bug 1016370 SUSE bug 1017870 SUSE bug 1026634 SUSE bug 1029445 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures. Low CVE-2016-10012 SUSE bug 1006166 SUSE bug 1016336 SUSE bug 1016369 SUSE bug 1016370 SUSE bug 1017870 SUSE bug 1026634 SUSE bug 1035742 SUSE bug 1073044 SUSE bug 1092582 SUSE bug 1138392 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation. Moderate CVE-2016-10013 SUSE bug 1016340 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations. Moderate CVE-2016-10024 SUSE bug 1014298 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check. Moderate CVE-2016-10025 SUSE bug 1014300 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0. Moderate CVE-2016-10028 SUSE bug 1017084 SUSE bug 1017085 SUSE bug 1185981 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts. Moderate CVE-2016-10029 SUSE bug 1017081 SUSE bug 1017082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call. Low CVE-2016-10044 SUSE bug 1023992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure. Low CVE-2016-10087 SUSE bug 1017646 SUSE bug 1149680 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image. Moderate CVE-2016-10092 SUSE bug 1017693 SUSE bug 1122679 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow. Moderate CVE-2016-10093 SUSE bug 1017693 SUSE bug 1122679 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image. Moderate CVE-2016-10094 SUSE bug 1017693 SUSE bug 1122679 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file. Moderate CVE-2016-10095 SUSE bug 1017690 SUSE bug 960341 SUSE bug 983436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after the handle has been released through the SCardReleaseContext function. Moderate CVE-2016-10109 SUSE bug 1017902 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as demonstrated by mcryptd(md5). Moderate CVE-2016-10147 SUSE bug 1020381 SUSE bug 1020429 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations. Low CVE-2016-10155 SUSE bug 1021129 SUSE bug 1024183 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229. Important CVE-2016-10156 SUSE bug 1020601 SUSE bug 1021969 SUSE bug 1086936 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read. Moderate CVE-2016-10165 SUSE bug 1021364 SUSE bug 1064069 SUSE bug 1070162 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file. Low CVE-2016-10198 SUSE bug 1023259 SUSE bug 1024014 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value. Low CVE-2016-10199 SUSE bug 1023259 SUSE bug 1024017 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image. Important CVE-2016-10208 SUSE bug 1023377 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands. Moderate CVE-2016-10214 SUSE bug 1024244 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. Low CVE-2016-10228 SUSE bug 1027496 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag. Critical CVE-2016-10229 SUSE bug 1032268 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22. Moderate CVE-2016-10266 SUSE bug 1017694 SUSE bug 1031263 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8. Moderate CVE-2016-10267 SUSE bug 1017694 SUSE bug 1031262 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23. Moderate CVE-2016-10268 SUSE bug 1017693 SUSE bug 1031255 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6 and 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2. Moderate CVE-2016-10269 SUSE bug 1017693 SUSE bug 1031254 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22. Moderate CVE-2016-10270 SUSE bug 1031250 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read and buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 1" and libtiff/tif_fax3.c:413:13. Moderate CVE-2016-10271 SUSE bug 1031249 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "WRITE of size 2048" and libtiff/tif_next.c:64:9. Moderate CVE-2016-10272 SUSE bug 1031247 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file. Low CVE-2016-10371 SUSE bug 1038438 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings. Moderate CVE-2016-10739 SUSE bug 1122729 SUSE bug 1155094 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure. Moderate CVE-2016-10741 SUSE bug 1114920 SUSE bug 1124010 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. Important CVE-2016-10745 SUSE bug 1132174 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886. Moderate CVE-2016-10746 SUSE bug 1133150 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry. Moderate CVE-2016-10905 SUSE bug 1146312 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name. Moderate CVE-2016-1234 SUSE bug 1020940 SUSE bug 969727 SUSE bug 988770 SUSE bug 988782 SUSE bug 989127 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c. Low CVE-2016-1237 SUSE bug 986570 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. Moderate CVE-2016-1238 SUSE bug 1108749 SUSE bug 1123389 SUSE bug 987887 SUSE bug 988311 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. Critical CVE-2016-1283 SUSE bug 960837 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. Moderate CVE-2016-1521 SUSE bug 965803 SUSE bug 965806 SUSE bug 965807 SUSE bug 965810 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion). Low CVE-2016-1544 SUSE bug 966514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key." Important CVE-2016-1567 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command. Moderate CVE-2016-1568 SUSE bug 961332 SUSE bug 961333 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates. Important CVE-2016-1570 SUSE bug 960861 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check. Low CVE-2016-1571 SUSE bug 960861 SUSE bug 960862 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory. Important CVE-2016-1575 SUSE bug 968092 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. Important CVE-2016-1583 SUSE bug 1020452 SUSE bug 1052256 SUSE bug 983143 SUSE bug 983144 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration. Moderate CVE-2016-1714 SUSE bug 961691 SUSE bug 961692 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Moderate CVE-2016-1762 SUSE bug 1123919 SUSE bug 981040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Important CVE-2016-1833 SUSE bug 1123919 SUSE bug 981108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. Moderate CVE-2016-1834 SUSE bug 1123919 SUSE bug 981041 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document. Important CVE-2016-1835 SUSE bug 1123919 SUSE bug 981109 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document. Important CVE-2016-1836 SUSE bug 1174862 SUSE bug 981110 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document. Important CVE-2016-1837 SUSE bug 1123919 SUSE bug 981111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Important CVE-2016-1838 SUSE bug 1123919 SUSE bug 981112 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Moderate CVE-2016-1839 SUSE bug 1039069 SUSE bug 1039661 SUSE bug 1069433 SUSE bug 1069690 SUSE bug 1123919 SUSE bug 963963 SUSE bug 981114 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. Important CVE-2016-1840 SUSE bug 1123919 SUSE bug 981115 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream. Important CVE-2016-1866 SUSE bug 965403 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue. Low CVE-2016-1922 SUSE bug 962320 SUSE bug 962321 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate. Important CVE-2016-1950 SUSE bug 969894 SUSE bug 970257 SUSE bug 970377 SUSE bug 970378 SUSE bug 970379 SUSE bug 970380 SUSE bug 970381 SUSE bug 970431 SUSE bug 970433 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding. Important CVE-2016-1979 SUSE bug 969894 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS. Low CVE-2016-1981 SUSE bug 963782 SUSE bug 963783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. Low CVE-2016-2037 SUSE bug 1028410 SUSE bug 963448 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. Low CVE-2016-2105 SUSE bug 977584 SUSE bug 977614 SUSE bug 978492 SUSE bug 989902 SUSE bug 990369 SUSE bug 990370 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. Low CVE-2016-2106 SUSE bug 977584 SUSE bug 977615 SUSE bug 978492 SUSE bug 979279 SUSE bug 990369 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. Important CVE-2016-2107 SUSE bug 976942 SUSE bug 977584 SUSE bug 977616 SUSE bug 978492 SUSE bug 990369 SUSE bug 990370 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. Moderate CVE-2016-2109 SUSE bug 1015243 SUSE bug 976942 SUSE bug 977584 SUSE bug 978492 SUSE bug 990369 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security. Moderate CVE-2016-2110 SUSE bug 1009711 SUSE bug 973031 SUSE bug 973033 SUSE bug 973036 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005. Moderate CVE-2016-2111 SUSE bug 973032 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream. Moderate CVE-2016-2112 SUSE bug 973031 SUSE bug 973033 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate. Moderate CVE-2016-2113 SUSE bug 973031 SUSE bug 973033 SUSE bug 973034 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream. Moderate CVE-2016-2115 SUSE bug 973036 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK." Moderate CVE-2016-2118 SUSE bug 971965 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag. Moderate CVE-2016-2119 SUSE bug 986869 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation. Important CVE-2016-2123 SUSE bug 1014437 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required. Moderate CVE-2016-2124 SUSE bug 1014440 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. Low CVE-2016-2125 SUSE bug 1014441 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions. Low CVE-2016-2126 SUSE bug 1014442 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261. Important CVE-2016-2150 SUSE bug 982385 SUSE bug 982386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data. Important CVE-2016-2176 SUSE bug 978224 SUSE bug 990369 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c. Important CVE-2016-2177 SUSE bug 982575 SUSE bug 999075 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack. Low CVE-2016-2178 SUSE bug 1004104 SUSE bug 983249 SUSE bug 983519 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. Moderate CVE-2016-2179 SUSE bug 1004104 SUSE bug 994844 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command. Low CVE-2016-2180 SUSE bug 1003811 SUSE bug 990419 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. Low CVE-2016-2181 SUSE bug 1004104 SUSE bug 994749 SUSE bug 994844 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. Low CVE-2016-2182 SUSE bug 1004104 SUSE bug 993819 SUSE bug 994844 SUSE bug 995959 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. Moderate CVE-2016-2183 SUSE bug 1001912 SUSE bug 1024218 SUSE bug 1027038 SUSE bug 1034689 SUSE bug 1056614 SUSE bug 1171693 SUSE bug 994844 SUSE bug 995359 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor. Moderate CVE-2016-2184 SUSE bug 1020452 SUSE bug 971125 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. Moderate CVE-2016-2185 SUSE bug 1020452 SUSE bug 971124 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. Moderate CVE-2016-2186 SUSE bug 1020452 SUSE bug 970958 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. Moderate CVE-2016-2187 SUSE bug 1020452 SUSE bug 971919 SUSE bug 971944 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS. Low CVE-2016-2198 SUSE bug 964413 SUSE bug 964415 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings. Low CVE-2016-2270 SUSE bug 965315 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP. Low CVE-2016-2271 SUSE bug 965317 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor. Moderate CVE-2016-2384 SUSE bug 1020452 SUSE bug 966693 SUSE bug 967773 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers. Low CVE-2016-2391 SUSE bug 967012 SUSE bug 967013 SUSE bug 967101 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet. Low CVE-2016-2392 SUSE bug 967012 SUSE bug 967090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function. Important CVE-2016-2538 SUSE bug 967969 SUSE bug 968004 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. Important CVE-2016-2779 SUSE bug 1000998 SUSE bug 1018892 SUSE bug 946429 SUSE bug 968375 SUSE bug 968674 SUSE bug 968675 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Moderate CVE-2016-2834 SUSE bug 983549 SUSE bug 983639 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control. Low CVE-2016-2841 SUSE bug 969350 SUSE bug 969351 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite loop and hang) via unspecified vectors. Moderate CVE-2016-3044 SUSE bug 1013013 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move. Low CVE-2016-3070 SUSE bug 979215 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name. Low CVE-2016-3075 SUSE bug 1123874 SUSE bug 973164 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal. Moderate CVE-2016-3119 SUSE bug 971942 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. Low CVE-2016-3120 SUSE bug 991088 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. Moderate CVE-2016-3134 SUSE bug 1020452 SUSE bug 1052256 SUSE bug 1115893 SUSE bug 971126 SUSE bug 971793 SUSE bug 986362 SUSE bug 986365 SUSE bug 986377 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions. Moderate CVE-2016-3137 SUSE bug 1020452 SUSE bug 970970 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. Moderate CVE-2016-3139 SUSE bug 1020452 SUSE bug 970909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. Moderate CVE-2016-3140 SUSE bug 1020452 SUSE bug 970892 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted GIF file. Moderate CVE-2016-3186 SUSE bug 973340 SUSE bug 983268 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block. Low CVE-2016-3189 SUSE bug 985657 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542. Low CVE-2016-3191 SUSE bug 971741 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image. Low CVE-2016-3622 SUSE bug 974449 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v or (2) h parameter to 0. Low CVE-2016-3623 SUSE bug 974617 SUSE bug 974618 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. Moderate CVE-2016-3627 SUSE bug 1026099 SUSE bug 1026101 SUSE bug 1123919 SUSE bug 972335 SUSE bug 975947 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable. Low CVE-2016-3658 SUSE bug 974840 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set. Low CVE-2016-3695 SUSE bug 1023051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container. Moderate CVE-2016-3697 SUSE bug 976777 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. Low CVE-2016-3705 SUSE bug 1017497 SUSE bug 1123919 SUSE bug 975947 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458. Moderate CVE-2016-3706 SUSE bug 1123874 SUSE bug 980483 SUSE bug 997423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Possible cross-site scripting vulnerability in libxml after commit 960f0e2. Moderate CVE-2016-3709 SUSE bug 1201978 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue. Moderate CVE-2016-3710 SUSE bug 978158 SUSE bug 978164 SUSE bug 978167 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. Low CVE-2016-3712 SUSE bug 978160 SUSE bug 978164 SUSE bug 978167 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. Moderate CVE-2016-3841 SUSE bug 1052256 SUSE bug 1115893 SUSE bug 992566 SUSE bug 992569 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write. Low CVE-2016-3945 SUSE bug 974614 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor. Moderate CVE-2016-3951 SUSE bug 974418 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp. Low CVE-2016-3990 SUSE bug 975069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles. Low CVE-2016-3991 SUSE bug 975070 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes. Moderate CVE-2016-4002 SUSE bug 975136 SUSE bug 975138 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate. Moderate CVE-2016-4008 SUSE bug 982779 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR). Low CVE-2016-4020 SUSE bug 975700 SUSE bug 975907 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0. Low CVE-2016-4074 SUSE bug 1014176 SUSE bug 976992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data. Moderate CVE-2016-4425 SUSE bug 978163 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets. Low CVE-2016-4429 SUSE bug 1081556 SUSE bug 1123874 SUSE bug 980854 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors. Low CVE-2016-4439 SUSE bug 980711 SUSE bug 980716 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode. Moderate CVE-2016-4440 SUSE bug 980829 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command. Low CVE-2016-4441 SUSE bug 980723 SUSE bug 980724 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command. Low CVE-2016-4453 SUSE bug 982223 SUSE bug 982225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read. Low CVE-2016-4454 SUSE bug 982222 SUSE bug 982224 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716. Moderate CVE-2016-4472 SUSE bug 1034050 SUSE bug 939077 SUSE bug 980391 SUSE bug 983985 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. Low CVE-2016-4476 SUSE bug 978172 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command. Moderate CVE-2016-4477 SUSE bug 978175 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory. Important CVE-2016-4480 SUSE bug 1072198 SUSE bug 1072223 SUSE bug 978288 SUSE bug 978295 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. Low CVE-2016-4482 SUSE bug 1020452 SUSE bug 978401 SUSE bug 978445 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. Low CVE-2016-4483 SUSE bug 1026101 SUSE bug 1123919 SUSE bug 978395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. Moderate CVE-2016-4565 SUSE bug 1020452 SUSE bug 979548 SUSE bug 980363 SUSE bug 980883 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOC_DQBUF ioctl call. Moderate CVE-2016-4568 SUSE bug 979022 SUSE bug 981516 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface. Low CVE-2016-4569 SUSE bug 1020452 SUSE bug 979213 SUSE bug 979879 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356. Important CVE-2016-4574 SUSE bug 1135436 SUSE bug 979261 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl." Moderate CVE-2016-4579 SUSE bug 1135436 SUSE bug 979906 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document. Moderate CVE-2016-4658 SUSE bug 1005544 SUSE bug 1014873 SUSE bug 1069433 SUSE bug 1078813 SUSE bug 1123919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Moderate CVE-2016-4738 SUSE bug 1005591 SUSE bug 1123130 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls. Moderate CVE-2016-4794 SUSE bug 980265 SUSE bug 981517 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function. Low CVE-2016-4804 SUSE bug 980364 SUSE bug 980377 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure. Moderate CVE-2016-4912 SUSE bug 1074356 SUSE bug 980722 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem. Moderate CVE-2016-4913 SUSE bug 1115893 SUSE bug 870618 SUSE bug 980725 SUSE bug 985132 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command. Low CVE-2016-4952 SUSE bug 981266 SUSE bug 981276 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state. Moderate CVE-2016-4964 SUSE bug 981399 SUSE bug 981401 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset. Low CVE-2016-5011 SUSE bug 988361 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command. Low CVE-2016-5105 SUSE bug 982017 SUSE bug 982024 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command. Low CVE-2016-5106 SUSE bug 982018 SUSE bug 982025 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors. Low CVE-2016-5107 SUSE bug 982019 SUSE bug 982026 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call. Low CVE-2016-5126 SUSE bug 982285 SUSE bug 982286 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot. Moderate CVE-2016-5180 SUSE bug 1007728 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode. Moderate CVE-2016-5238 SUSE bug 982959 SUSE bug 982960 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message. Moderate CVE-2016-5244 SUSE bug 983213 SUSE bug 986225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. Important CVE-2016-5300 SUSE bug 983216 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr. Moderate CVE-2016-5314 SUSE bug 984831 SUSE bug 987351 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool. Moderate CVE-2016-5316 SUSE bug 984837 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file. Moderate CVE-2016-5317 SUSE bug 984842 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the _TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted tiff. Moderate CVE-2016-5318 SUSE bug 1007276 SUSE bug 1017690 SUSE bug 1040322 SUSE bug 960341 SUSE bug 974621 SUSE bug 983436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5314. Reason: This candidate is a reservation duplicate of CVE-2016-5314. Notes: All CVE users should reference CVE-2016-5314 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2016-5320 SUSE bug 1007284 SUSE bug 984808 SUSE bug 987351 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image. Moderate CVE-2016-5321 SUSE bug 984813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image. Moderate CVE-2016-5323 SUSE bug 984815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information. Low CVE-2016-5337 SUSE bug 983961 SUSE bug 983973 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer. Low CVE-2016-5338 SUSE bug 983982 SUSE bug 983984 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5696. Reason: This candidate is a reservation duplicate of CVE-2016-5696. Notes: All CVE users should reference CVE-2016-5696 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2016-5389 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. Low CVE-2016-5403 SUSE bug 990923 SUSE bug 991080 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data. Moderate CVE-2016-5407 SUSE bug 1003017 SUSE bug 1123148 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method. Low CVE-2016-5410 SUSE bug 992772 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction. Moderate CVE-2016-5412 SUSE bug 1013013 SUSE bug 991065 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures. Important CVE-2016-5417 SUSE bug 1123874 SUSE bug 991670 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow. Important CVE-2016-5636 SUSE bug 1065451 SUSE bug 1106262 SUSE bug 985177 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means. Moderate CVE-2016-5652 SUSE bug 1007280 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack. Moderate CVE-2016-5696 SUSE bug 1020452 SUSE bug 1175721 SUSE bug 989152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL. Moderate CVE-2016-5699 SUSE bug 1122729 SUSE bug 1130840 SUSE bug 985348 SUSE bug 985351 SUSE bug 986630 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow. Moderate CVE-2016-5735 SUSE bug 1173616 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root. Moderate CVE-2016-5759 SUSE bug 990200 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call. Moderate CVE-2016-5828 SUSE bug 986569 SUSE bug 991065 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5314. Reason: This candidate is a reservation duplicate of CVE-2016-5314. Notes: All CVE users should reference CVE-2016-5314 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2016-5875 SUSE bug 1007284 SUSE bug 984809 SUSE bug 984831 SUSE bug 987351 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability. Moderate CVE-2016-6130 SUSE bug 987542 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability. Moderate CVE-2016-6136 SUSE bug 988153 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file. Low CVE-2016-6163 SUSE bug 977985 SUSE bug 987877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink. Moderate CVE-2016-6197 SUSE bug 988708 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c. Moderate CVE-2016-6198 SUSE bug 988708 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided. Moderate CVE-2016-6210 SUSE bug 1001712 SUSE bug 1105010 SUSE bug 1138392 SUSE bug 989363 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts. Low CVE-2016-6213 SUSE bug 988964 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer. Moderate CVE-2016-6223 SUSE bug 990460 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries. Important CVE-2016-6258 SUSE bug 1072198 SUSE bug 1072223 SUSE bug 988675 SUSE bug 988692 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check. Moderate CVE-2016-6259 SUSE bug 988676 SUSE bug 988694 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. Low CVE-2016-6261 SUSE bug 1118435 SUSE bug 1173590 SUSE bug 990190 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948. Moderate CVE-2016-6262 SUSE bug 1014473 SUSE bug 1173590 SUSE bug 1190777 SUSE bug 990189 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data. Low CVE-2016-6263 SUSE bug 1118435 SUSE bug 990191 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. Moderate CVE-2016-6302 SUSE bug 1004104 SUSE bug 994844 SUSE bug 995324 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. Low CVE-2016-6303 SUSE bug 1004104 SUSE bug 1115893 SUSE bug 994844 SUSE bug 995377 SUSE bug 999665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions. Moderate CVE-2016-6304 SUSE bug 1001706 SUSE bug 1003811 SUSE bug 1004104 SUSE bug 1005579 SUSE bug 1021375 SUSE bug 999665 SUSE bug 999666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c. Low CVE-2016-6306 SUSE bug 1004104 SUSE bug 999665 SUSE bug 999668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits. Moderate CVE-2016-6313 SUSE bug 1123792 SUSE bug 994157 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer. Moderate CVE-2016-6318 SUSE bug 1123113 SUSE bug 992966 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER. Low CVE-2016-6321 SUSE bug 1007188 SUSE bug 1123796 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation. Moderate CVE-2016-6323 SUSE bug 994359 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer. Low CVE-2016-6351 SUSE bug 990835 SUSE bug 990843 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file. Moderate CVE-2016-6352 SUSE bug 1027024 SUSE bug 991450 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability. Moderate CVE-2016-6480 SUSE bug 1004418 SUSE bug 991608 SUSE bug 991667 SUSE bug 992568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack. Moderate CVE-2016-6489 SUSE bug 991464 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer. Low CVE-2016-6490 SUSE bug 991466 SUSE bug 993854 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string. Moderate CVE-2016-6515 SUSE bug 1115893 SUSE bug 992533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111. Moderate CVE-2016-6786 SUSE bug 1015160 SUSE bug 1025626 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 31095224. Moderate CVE-2016-6787 SUSE bug 1015160 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option. Moderate CVE-2016-6828 SUSE bug 1052256 SUSE bug 994296 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active. Moderate CVE-2016-6833 SUSE bug 994774 SUSE bug 994775 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object. Low CVE-2016-6836 SUSE bug 994760 SUSE bug 994761 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference. Low CVE-2016-6888 SUSE bug 994771 SUSE bug 994772 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL. Low CVE-2016-7031 SUSE bug 997025 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function. Moderate CVE-2016-7032 SUSE bug 1007501 SUSE bug 1007766 SUSE bug 1011975 SUSE bug 1011976 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation. Important CVE-2016-7052 SUSE bug 1001148 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible erroneous outcome of public-key operations with specially crafted input. Among EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation. Impact was not analyzed in detail, because pre-requisites for attack are considered unlikely. Namely multiple clients have to choose the curve in question and the server has to share the private key among them, neither of which is default behaviour. Even then only clients that chose the curve will be affected. Low CVE-2016-7055 SUSE bug 1009528 SUSE bug 1021641 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. Moderate CVE-2016-7056 SUSE bug 1005878 SUSE bug 1019334 SUSE bug 1148697 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges. Moderate CVE-2016-7076 SUSE bug 1007501 SUSE bug 1011975 SUSE bug 1011976 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables. Important CVE-2016-7092 SUSE bug 995785 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation. Important CVE-2016-7093 SUSE bug 995789 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update. Moderate CVE-2016-7094 SUSE bug 995792 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. Low CVE-2016-7097 SUSE bug 1021258 SUSE bug 1052256 SUSE bug 870618 SUSE bug 995968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string. Low CVE-2016-7116 SUSE bug 996441 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings. Moderate CVE-2016-7155 SUSE bug 997858 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast. Moderate CVE-2016-7156 SUSE bug 997859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK. Moderate CVE-2016-7157 SUSE bug 997860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet. Moderate CVE-2016-7161 SUSE bug 1001151 SUSE bug 1001152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow. Moderate CVE-2016-7167 SUSE bug 998760 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command. Moderate CVE-2016-7170 SUSE bug 998516 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size. Low CVE-2016-7421 SUSE bug 999661 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value. Moderate CVE-2016-7422 SUSE bug 1000346 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects. Moderate CVE-2016-7423 SUSE bug 1000397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. Moderate CVE-2016-7425 SUSE bug 1115893 SUSE bug 999932 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device. Moderate CVE-2016-7466 SUSE bug 1000345 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. Moderate CVE-2016-7545 SUSE bug 1000998 SUSE bug 968375 SUSE bug 968674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted string. Moderate CVE-2016-7567 SUSE bug 1001600 SUSE bug 1074356 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it. Moderate CVE-2016-7777 SUSE bug 1000106 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags. Moderate CVE-2016-7907 SUSE bug 1002549 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags. Moderate CVE-2016-7908 SUSE bug 1002550 SUSE bug 1003030 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0. Moderate CVE-2016-7909 SUSE bug 1002557 SUSE bug 1003032 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed. Moderate CVE-2016-7910 SUSE bug 1010716 SUSE bug 1115893 SUSE bug 1196722 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure. Important CVE-2016-7913 SUSE bug 1010478 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite. Moderate CVE-2016-7914 SUSE bug 1010475 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response. Moderate CVE-2016-7947 SUSE bug 1003000 SUSE bug 1159415 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data. Moderate CVE-2016-7948 SUSE bug 1003000 SUSE bug 1159415 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands. Moderate CVE-2016-7994 SUSE bug 1003613 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes. Moderate CVE-2016-7995 SUSE bug 1003612 SUSE bug 1003870 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process. Moderate CVE-2016-8576 SUSE bug 1003878 SUSE bug 1004016 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation. Moderate CVE-2016-8577 SUSE bug 1003893 SUSE bug 1004021 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation. Moderate CVE-2016-8578 SUSE bug 1003894 SUSE bug 1004023 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. Important CVE-2016-8610 SUSE bug 1005878 SUSE bug 1005879 SUSE bug 1110018 SUSE bug 1120592 SUSE bug 1126909 SUSE bug 1148697 SUSE bug 982575 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. Low CVE-2016-8615 SUSE bug 1005633 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password. Low CVE-2016-8616 SUSE bug 1005634 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`. Low CVE-2016-8617 SUSE bug 1005635 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. Moderate CVE-2016-8618 SUSE bug 1005637 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. Moderate CVE-2016-8619 SUSE bug 1005638 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. Low CVE-2016-8620 SUSE bug 1005640 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. Moderate CVE-2016-8621 SUSE bug 1005642 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer. Low CVE-2016-8622 SUSE bug 1005643 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. Low CVE-2016-8623 SUSE bug 1005645 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. Moderate CVE-2016-8624 SUSE bug 1005646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host. Low CVE-2016-8625 SUSE bug 1005649 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction. Moderate CVE-2016-8630 SUSE bug 1009222 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability. Moderate CVE-2016-8632 SUSE bug 1008831 SUSE bug 1012852 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets. Moderate CVE-2016-8633 SUSE bug 1008833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials. Low CVE-2016-8637 SUSE bug 1008340 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted application that makes sendto system calls, related to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. Moderate CVE-2016-8645 SUSE bug 1009969 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data. Moderate CVE-2016-8646 SUSE bug 1010150 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent. Important CVE-2016-8650 SUSE bug 1011820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions. Moderate CVE-2016-8655 SUSE bug 1012754 SUSE bug 1012759 SUSE bug 1013822 SUSE bug 1052365 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value. Moderate CVE-2016-8667 SUSE bug 1004702 SUSE bug 1005004 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size. Moderate CVE-2016-8668 SUSE bug 1004706 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base. Moderate CVE-2016-8669 SUSE bug 1004707 SUSE bug 1005005 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue." Moderate CVE-2016-8858 SUSE bug 1005480 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes. Important CVE-2016-8867 SUSE bug 1007249 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position. Low CVE-2016-8909 SUSE bug 1006536 SUSE bug 1007160 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count. Low CVE-2016-8910 SUSE bug 1006538 SUSE bug 1007157 SUSE bug 1024178 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low. Low CVE-2016-9015 SUSE bug 1023502 SUSE bug 1024540 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. Critical CVE-2016-9063 SUSE bug 1009026 SUSE bug 1010424 SUSE bug 1047240 SUSE bug 1123115 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference) via a large svg file. Moderate CVE-2016-9082 SUSE bug 1007255 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device. Low CVE-2016-9101 SUSE bug 1007391 SUSE bug 1013668 SUSE bug 1024181 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number. Moderate CVE-2016-9102 SUSE bug 1007450 SUSE bug 1014256 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them. Low CVE-2016-9103 SUSE bug 1007454 SUSE bug 1014259 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access. Low CVE-2016-9104 SUSE bug 1007493 SUSE bug 1014297 SUSE bug 1034990 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object. Low CVE-2016-9105 SUSE bug 1007494 SUSE bug 1014279 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector. Low CVE-2016-9106 SUSE bug 1007495 SUSE bug 1014299 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity. Moderate CVE-2016-9191 SUSE bug 1008842 SUSE bug 1027179 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing td_nstrips in TIFF_STRIPCHOP mode. Moderate CVE-2016-9273 SUSE bug 1010163 SUSE bug 1017693 SUSE bug 1150480 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tag values. Moderate CVE-2016-9297 SUSE bug 1010161 SUSE bug 1011103 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration, which allows local users to cause a denial of service (NULL pointer dereference and panic) or possibly have unspecified other impact via a crafted application that uses the big_key data type. Moderate CVE-2016-9313 SUSE bug 1012356 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation. Moderate CVE-2016-9377 SUSE bug 1009108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery. Moderate CVE-2016-9378 SUSE bug 1009108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file. Moderate CVE-2016-9379 SUSE bug 1009111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file. Moderate CVE-2016-9380 SUSE bug 1009111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability. Important CVE-2016-9381 SUSE bug 1009109 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode. Moderate CVE-2016-9382 SUSE bug 1009103 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions. Moderate CVE-2016-9383 SUSE bug 1009107 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table. Low CVE-2016-9384 SUSE bug 1009105 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks. Moderate CVE-2016-9385 SUSE bug 1009104 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values. Moderate CVE-2016-9386 SUSE bug 1009100 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address. Low CVE-2016-9401 SUSE bug 1010845 SUSE bug 1044328 SUSE bug 1123788 SUSE bug 1159416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9297. Moderate CVE-2016-9448 SUSE bug 1010161 SUSE bug 1011103 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one. Important CVE-2016-9453 SUSE bug 1007280 SUSE bug 1011107 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100. Moderate CVE-2016-9538 SUSE bug 1004519 SUSE bug 1011841 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data. Important CVE-2016-9555 SUSE bug 1011685 SUSE bug 1012183 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution. Critical CVE-2016-9577 SUSE bug 1023078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash. Critical CVE-2016-9578 SUSE bug 1023078 SUSE bug 1023079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. Moderate CVE-2016-9586 SUSE bug 1015332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest. Moderate CVE-2016-9588 SUSE bug 1015703 SUSE bug 1017512 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable. Important CVE-2016-9594 SUSE bug 1016738 SUSE bug 1017161 SUSE bug 1042181 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host. Moderate CVE-2016-9602 SUSE bug 1020427 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring. Moderate CVE-2016-9604 SUSE bug 1035576 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access. Moderate CVE-2016-9637 SUSE bug 1011652 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. Low CVE-2016-9639 SUSE bug 1012398 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Moderate CVE-2016-9756 SUSE bug 1013038 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS. Low CVE-2016-9776 SUSE bug 1013285 SUSE bug 1013657 SUSE bug 1024182 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command. Moderate CVE-2016-9794 SUSE bug 1013533 SUSE bug 1013543 SUSE bug 1013604 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to a free operation associated with a new dump that started earlier than anticipated. Important CVE-2016-9806 SUSE bug 1013540 SUSE bug 1017589 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Moderate CVE-2016-9840 SUSE bug 1003579 SUSE bug 1022633 SUSE bug 1023215 SUSE bug 1038505 SUSE bug 1062104 SUSE bug 1120866 SUSE bug 1123150 SUSE bug 1127473 SUSE bug 1184301 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Moderate CVE-2016-9841 SUSE bug 1003579 SUSE bug 1022633 SUSE bug 1038505 SUSE bug 1064070 SUSE bug 1070162 SUSE bug 1120866 SUSE bug 1123150 SUSE bug 1127473 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. Moderate CVE-2016-9843 SUSE bug 1003580 SUSE bug 1013882 SUSE bug 1038505 SUSE bug 1062104 SUSE bug 1116686 SUSE bug 1120866 SUSE bug 1123150 SUSE bug 1127473 SUSE bug 1184301 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes. Low CVE-2016-9845 SUSE bug 1013767 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host. Low CVE-2016-9846 SUSE bug 1013764 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host. Low CVE-2016-9907 SUSE bug 1014109 SUSE bug 1014490 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes. Low CVE-2016-9908 SUSE bug 1014514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host. Low CVE-2016-9911 SUSE bug 1014111 SUSE bug 1014507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host. Low CVE-2016-9912 SUSE bug 1014112 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup. Low CVE-2016-9913 SUSE bug 1014110 SUSE bug 1014311 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS. Low CVE-2016-9921 SUSE bug 1014702 SUSE bug 1015169 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving blit pitch values. Low CVE-2016-9922 SUSE bug 1014702 SUSE bug 1015169 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS. Low CVE-2016-9923 SUSE bug 1014703 SUSE bug 1015145 SUSE bug 1015148 SUSE bug 1015154 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix. Low CVE-2016-9932 SUSE bug 1012651 SUSE bug 1016340 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container. Moderate CVE-2016-9962 SUSE bug 1012568 SUSE bug 1173425 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c. Critical CVE-2017-0379 SUSE bug 1055837 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432. Moderate CVE-2017-0381 SUSE bug 1020102 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32255299. Moderate CVE-2017-0386 SUSE bug 1020123 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. Important CVE-2017-0663 SUSE bug 1044337 SUSE bug 1123919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors. Moderate CVE-2017-0861 SUSE bug 1088260 SUSE bug 1088268 SUSE bug 1091815 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. Moderate CVE-2017-1000099 SUSE bug 1051645 SUSE bug 1053919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS. Low CVE-2017-1000100 SUSE bug 1051644 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`. Moderate CVE-2017-1000101 SUSE bug 1051643 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW. Important CVE-2017-1000111 SUSE bug 1052365 SUSE bug 1052367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017). Moderate CVE-2017-1000249 SUSE bug 1056838 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space. Important CVE-2017-1000251 SUSE bug 1057389 SUSE bug 1057950 SUSE bug 1070535 SUSE bug 1072162 SUSE bug 1120758 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote. Low CVE-2017-1000254 SUSE bug 1061876 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default. Important CVE-2017-1000256 SUSE bug 1062563 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. Moderate CVE-2017-1000257 SUSE bug 1063824 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier. Important CVE-2017-1000366 SUSE bug 1037551 SUSE bug 1039357 SUSE bug 1071319 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution. Important CVE-2017-1000367 SUSE bug 1007501 SUSE bug 1039361 SUSE bug 1042146 SUSE bug 1077345 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution. Important CVE-2017-1000368 SUSE bug 1039361 SUSE bug 1042146 SUSE bug 1045986 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems. Low CVE-2017-1000370 SUSE bug 1037551 SUSE bug 1039346 SUSE bug 1039349 SUSE bug 1039354 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems. Low CVE-2017-1000371 SUSE bug 1037551 SUSE bug 1039346 SUSE bug 1039349 SUSE bug 1039354 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time. Low CVE-2017-1000380 SUSE bug 1044125 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. Important CVE-2017-1000381 SUSE bug 1044946 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary. Low CVE-2017-1000382 SUSE bug 1065958 SUSE bug 1070955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366. Important CVE-2017-1000408 SUSE bug 1039357 SUSE bug 1071319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366. Important CVE-2017-1000409 SUSE bug 1071319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing. Important CVE-2017-10661 SUSE bug 1053152 SUSE bug 1053153 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt. Moderate CVE-2017-10664 SUSE bug 1046636 SUSE bug 1046637 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages. Moderate CVE-2017-10806 SUSE bug 1047674 SUSE bug 1047675 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216. Moderate CVE-2017-10911 SUSE bug 1042863 SUSE bug 1043330 SUSE bug 1057378 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated. Important CVE-2017-11103 SUSE bug 1048278 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact. Important CVE-2017-11176 SUSE bug 1048275 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area. Moderate CVE-2017-11334 SUSE bug 1048902 SUSE bug 1048920 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. Moderate CVE-2017-11368 SUSE bug 1049819 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. Moderate CVE-2017-11423 SUSE bug 1049423 SUSE bug 1083915 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string. Important CVE-2017-11434 SUSE bug 1049381 SUSE bug 1049578 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error. Moderate CVE-2017-11462 SUSE bug 1056995 SUSE bug 1122468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero. Low CVE-2017-11464 SUSE bug 1049607 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. Low CVE-2017-11472 SUSE bug 1049580 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. Moderate CVE-2017-11473 SUSE bug 1049603 SUSE bug 1061680 SUSE bug 1087082 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. Important CVE-2017-11600 SUSE bug 1050231 SUSE bug 1096564 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer. Low CVE-2017-11613 SUSE bug 1082332 SUSE bug 1106853 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation. Moderate CVE-2017-12132 SUSE bug 1051791 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path. Low CVE-2017-12133 SUSE bug 1081556 SUSE bug 1123874 SUSE bug 980854 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation. Important CVE-2017-12134 SUSE bug 1051790 SUSE bug 1053919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transitive grants. Important CVE-2017-12135 SUSE bug 1051787 SUSE bug 1169392 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and host crash) or gain privileges on the host via vectors involving maptrack free list handling. Important CVE-2017-12136 SUSE bug 1051789 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref. Important CVE-2017-12137 SUSE bug 1051788 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text. Important CVE-2017-12150 SUSE bug 1058622 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack. Important CVE-2017-12151 SUSE bug 1058565 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash. Moderate CVE-2017-12153 SUSE bug 1058410 SUSE bug 1058624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. Moderate CVE-2017-12163 SUSE bug 1058410 SUSE bug 1058624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. Low CVE-2017-12173 SUSE bug 1061832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun." Important CVE-2017-12188 SUSE bug 1062604 SUSE bug 1096566 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation. Moderate CVE-2017-12192 SUSE bug 1062840 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations. Moderate CVE-2017-12193 SUSE bug 1066192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libpng before 1.6.32 does not properly check the length of chunks against the user limit. Low CVE-2017-12652 SUSE bug 1141493 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Moderate CVE-2017-12791 SUSE bug 1053955 SUSE bug 1062462 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable. Critical CVE-2017-12814 SUSE bug 1057727 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier. Low CVE-2017-12837 SUSE bug 1057724 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape. Moderate CVE-2017-12883 SUSE bug 1057721 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial of service (allocation failure and application crash) in the TIFFFetchStripThing function in tif_dirread.c during a tiff2pdf invocation. Moderate CVE-2017-12944 SUSE bug 1003874 SUSE bug 1054594 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames. Important CVE-2017-13077 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1063963 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients. Important CVE-2017-13078 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1063667 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients. Important CVE-2017-13079 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients. Important CVE-2017-13080 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1063667 SUSE bug 1063671 SUSE bug 1066295 SUSE bug 1105108 SUSE bug 1178872 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients. Important CVE-2017-13081 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1066295 SUSE bug 1105108 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames. Important CVE-2017-13082 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames. Important CVE-2017-13086 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients. Important CVE-2017-13087 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients. Important CVE-2017-13088 SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167. Important CVE-2017-13166 SUSE bug 1072865 SUSE bug 1085447 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993. Low CVE-2017-13167 SUSE bug 1072876 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233. Moderate CVE-2017-13168 SUSE bug 1072831 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel. Moderate CVE-2017-13215 SUSE bug 1075908 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053. Moderate CVE-2017-13220 SUSE bug 1076537 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update. Low CVE-2017-13672 SUSE bug 1056334 SUSE bug 1056336 SUSE bug 1084604 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function. Low CVE-2017-13673 SUSE bug 1056386 SUSE bug 1056387 SUSE bug 1084604 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. Low CVE-2017-13693 SUSE bug 1055713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. Low CVE-2017-13694 SUSE bug 1055705 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. Low CVE-2017-13695 SUSE bug 1055710 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets. Low CVE-2017-13711 SUSE bug 1056291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access. Moderate CVE-2017-14051 SUSE bug 1056588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact. Moderate CVE-2017-14062 SUSE bug 1056450 SUSE bug 1087709 SUSE bug 1118435 SUSE bug 1123123 SUSE bug 1173590 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path. Moderate CVE-2017-14106 SUSE bug 1056982 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR. Low CVE-2017-14140 SUSE bug 1057179 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file. Moderate CVE-2017-14160 SUSE bug 1059812 SUSE bug 1091072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write. Low CVE-2017-14167 SUSE bug 1057585 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array. Important CVE-2017-14316 SUSE bug 1056278 SUSE bug 1072198 SUSE bug 1072223 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory. Moderate CVE-2017-14340 SUSE bug 1058524 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation. Moderate CVE-2017-14489 SUSE bug 1059051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response. Moderate CVE-2017-14491 SUSE bug 1060354 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 SUSE bug 1063832 SUSE bug 1143944 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request. Moderate CVE-2017-14492 SUSE bug 1060355 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 SUSE bug 1063832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request. Moderate CVE-2017-14493 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 SUSE bug 1063832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests. Moderate CVE-2017-14494 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation. Important CVE-2017-14495 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request. Important CVE-2017-14496 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tpacket_rcv function in net/packet/af_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of service (buffer overflow, and disk and memory corruption) or possibly have unspecified other impact via crafted system calls. Critical CVE-2017-14497 SUSE bug 1059058 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. Important CVE-2017-14632 SUSE bug 1059809 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). Moderate CVE-2017-14633 SUSE bug 1059811 SUSE bug 1081833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791. Moderate CVE-2017-14695 SUSE bug 1053955 SUSE bug 1062462 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request. Moderate CVE-2017-14696 SUSE bug 1053955 SUSE bug 1062464 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. Important CVE-2017-14746 SUSE bug 1060427 SUSE bug 1069666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing. Moderate CVE-2017-14992 SUSE bug 1066210 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes. Low CVE-2017-15038 SUSE bug 1062069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference. Moderate CVE-2017-15102 SUSE bug 1066705 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist. Moderate CVE-2017-15107 SUSE bug 1076958 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls. Moderate CVE-2017-15115 SUSE bug 1068671 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS. Critical CVE-2017-15118 SUSE bug 1070147 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests, resulting in DoS. Low CVE-2017-15119 SUSE bug 1070144 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary. Moderate CVE-2017-15121 SUSE bug 1071726 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file. Moderate CVE-2017-15232 SUSE bug 1062937 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c. Moderate CVE-2017-15265 SUSE bug 1062520 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c. Moderate CVE-2017-15268 SUSE bug 1062942 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192. Moderate CVE-2017-15274 SUSE bug 1045327 SUSE bug 1062471 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory. Moderate CVE-2017-15275 SUSE bug 1063008 SUSE bug 1069666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation. Moderate CVE-2017-15289 SUSE bug 1063122 SUSE bug 1063123 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call. Moderate CVE-2017-15299 SUSE bug 1063416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346. Important CVE-2017-15649 SUSE bug 1064388 SUSE bug 1064392 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. Important CVE-2017-15670 SUSE bug 1064583 SUSE bug 1110160 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak). Important CVE-2017-15671 SUSE bug 1064569 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator. Moderate CVE-2017-15804 SUSE bug 1064580 SUSE bug 1110160 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application. Important CVE-2017-15868 SUSE bug 1071470 SUSE bug 1071471 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service. Moderate CVE-2017-15908 SUSE bug 1065276 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue. Low CVE-2017-16232 SUSE bug 1069213 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup. Moderate CVE-2017-16525 SUSE bug 1066618 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16526 SUSE bug 1066624 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16527 SUSE bug 1066625 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16528 SUSE bug 1066629 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16529 SUSE bug 1066650 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c. Moderate CVE-2017-16530 SUSE bug 1066668 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. Moderate CVE-2017-16531 SUSE bug 1066671 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16532 SUSE bug 1066673 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16533 SUSE bug 1066674 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16534 SUSE bug 1066693 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16536 SUSE bug 1066606 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16537 SUSE bug 1066573 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner). Moderate CVE-2017-16538 SUSE bug 1066569 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP. Moderate CVE-2017-16539 SUSE bug 1066801 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected. Moderate CVE-2017-16541 SUSE bug 1066489 SUSE bug 1107343 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon. Low CVE-2017-16548 SUSE bug 1066644 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0. Important CVE-2017-16612 SUSE bug 1065386 SUSE bug 1159415 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16643 SUSE bug 1067115 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16644 SUSE bug 1067118 SUSE bug 1087082 SUSE bug 1091815 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16646 SUSE bug 1067105 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. NOTE: the function was later renamed __dvb_frontend_free. Moderate CVE-2017-16648 SUSE bug 1067087 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16649 SUSE bug 1067085 SUSE bug 1067115 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-16650 SUSE bug 1067086 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h. Important CVE-2017-16818 SUSE bug 1063014 SUSE bug 1069253 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618. Moderate CVE-2017-16844 SUSE bug 1068648 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access. Low CVE-2017-16845 SUSE bug 1068613 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP. Low CVE-2017-16911 SUSE bug 1078674 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet. Moderate CVE-2017-16912 SUSE bug 1078673 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet. Moderate CVE-2017-16913 SUSE bug 1078672 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. Important CVE-2017-16939 SUSE bug 1069702 SUSE bug 1069708 SUSE bug 1115893 SUSE bug 1120260 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution. Important CVE-2017-16997 SUSE bug 1073231 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382. Low CVE-2017-17087 SUSE bug 1065958 SUSE bug 1070955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file. Important CVE-2017-17095 SUSE bug 1071031 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check. Important CVE-2017-17426 SUSE bug 1071479 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces. Moderate CVE-2017-17450 SUSE bug 1071695 SUSE bug 1074033 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-17558 SUSE bug 1072561 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. Moderate CVE-2017-17740 SUSE bug 1073313 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h. Important CVE-2017-17741 SUSE bug 1073311 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. Important CVE-2017-17805 SUSE bug 1073792 SUSE bug 1087082 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. Low CVE-2017-17806 SUSE bug 1073874 SUSE bug 1087082 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c. Moderate CVE-2017-17807 SUSE bug 1073860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability. Important CVE-2017-17833 SUSE bug 1090638 SUSE bug 1099519 SUSE bug 1126909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure. Low CVE-2017-17975 SUSE bug 1074426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. Important CVE-2017-18013 SUSE bug 1074317 SUSE bug 1082825 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action. Important CVE-2017-18017 SUSE bug 1074488 SUSE bug 1080255 SUSE bug 1091815 SUSE bug 1115893 SUSE bug 971126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls. Important CVE-2017-18075 SUSE bug 1077402 SUSE bug 1077404 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file. Important CVE-2017-18078 SUSE bug 1077925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) via an application with multiple threads. Moderate CVE-2017-18193 SUSE bug 1082478 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to cause a denial of service (deadlock) via DIO requests. Moderate CVE-2017-18204 SUSE bug 1083244 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions." Moderate CVE-2017-18207 SUSE bug 1083507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping. Moderate CVE-2017-18208 SUSE bug 1083494 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of service (use-after-free and BUG) or possibly have unspecified other impact by leveraging differences in skb handling between hns_nic_net_xmit_hw and hns_nic_net_xmit. Moderate CVE-2017-18218 SUSE bug 1084055 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data, which allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impact, as demonstrated by incompatibility between hns_get_sset_count and ethtool_get_strings. Important CVE-2017-18222 SUSE bug 1084529 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code. Low CVE-2017-18232 SUSE bug 1085413 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification. Moderate CVE-2017-18248 SUSE bug 1087018 SUSE bug 1087072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation. Moderate CVE-2017-18255 SUSE bug 1087082 SUSE bug 1087813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file. Low CVE-2017-18258 SUSE bug 1088279 SUSE bug 1088601 SUSE bug 1105166 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution. Moderate CVE-2017-18269 SUSE bug 1094150 SUSE bug 1118435 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function. Important CVE-2017-18342 SUSE bug 1099308 SUSE bug 1164453 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE). Important CVE-2017-18344 SUSE bug 1087082 SUSE bug 1102851 SUSE bug 1103203 SUSE bug 1103580 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated. Moderate CVE-2017-18551 SUSE bug 1146163 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c. Moderate CVE-2017-18595 SUSE bug 1149555 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt. Moderate CVE-2017-2584 SUSE bug 1019851 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. Moderate CVE-2017-2615 SUSE bug 1023004 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. Important CVE-2017-2616 SUSE bug 1023041 SUSE bug 1123789 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition. Important CVE-2017-2619 SUSE bug 1027147 SUSE bug 1036283 SUSE bug 1054017 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. Moderate CVE-2017-2620 SUSE bug 1024834 SUSE bug 1024972 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status). Moderate CVE-2017-2629 SUSE bug 1025379 SUSE bug 1042181 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process. Moderate CVE-2017-2630 SUSE bug 1025396 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process. Low CVE-2017-2633 SUSE bug 1026612 SUSE bug 1026636 SUSE bug 1074701 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service. Low CVE-2017-2635 SUSE bug 1027075 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c. Important CVE-2017-2647 SUSE bug 1030593 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call. Important CVE-2017-2671 SUSE bug 1027179 SUSE bug 1031003 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability. Important CVE-2017-2862 SUSE bug 1048289 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability. Important CVE-2017-2870 SUSE bug 1048289 SUSE bug 1048544 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability. Important CVE-2017-2885 SUSE bug 1052916 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. Moderate CVE-2017-3731 SUSE bug 1021641 SUSE bug 1022085 SUSE bug 1064118 SUSE bug 1064119 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem. Low CVE-2017-3732 SUSE bug 1021641 SUSE bug 1022086 SUSE bug 1049418 SUSE bug 1049421 SUSE bug 1049422 SUSE bug 1066242 SUSE bug 1071906 SUSE bug 957814 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. Moderate CVE-2017-3735 SUSE bug 1056058 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. Moderate CVE-2017-3736 SUSE bug 1066242 SUSE bug 1071906 SUSE bug 1076369 SUSE bug 957814 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository. Low CVE-2017-3738 SUSE bug 1071906 SUSE bug 1097757 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Low CVE-2017-5029 SUSE bug 1028848 SUSE bug 1028875 SUSE bug 1035905 SUSE bug 1123130 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient data validation in waitid allowed an user to escape sandboxes on Linux. Important CVE-2017-5123 SUSE bug 1062473 SUSE bug 1122971 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. Moderate CVE-2017-5200 SUSE bug 1011800 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value. Moderate CVE-2017-5225 SUSE bug 1019611 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5436 SUSE bug 1035082 SUSE bug 1035204 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations. Low CVE-2017-5525 SUSE bug 1020491 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations. Low CVE-2017-5526 SUSE bug 1020589 SUSE bug 1059777 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log. Low CVE-2017-5549 SUSE bug 1021256 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097. Low CVE-2017-5551 SUSE bug 1021258 SUSE bug 995968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands. Low CVE-2017-5552 SUSE bug 1021195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands. Low CVE-2017-5578 SUSE bug 1021481 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations. Low CVE-2017-5579 SUSE bug 1021741 SUSE bug 1022627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length. Moderate CVE-2017-5667 SUSE bug 1022541 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context. Moderate CVE-2017-5669 SUSE bug 1026914 SUSE bug 1102390 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Important CVE-2017-5715 SUSE bug 1068032 SUSE bug 1074562 SUSE bug 1074578 SUSE bug 1074701 SUSE bug 1074741 SUSE bug 1074919 SUSE bug 1075006 SUSE bug 1075007 SUSE bug 1075262 SUSE bug 1075419 SUSE bug 1076115 SUSE bug 1076372 SUSE bug 1076606 SUSE bug 1078353 SUSE bug 1080039 SUSE bug 1087887 SUSE bug 1087939 SUSE bug 1088147 SUSE bug 1089055 SUSE bug 1091815 SUSE bug 1095735 SUSE bug 1102517 SUSE bug 1105108 SUSE bug 1126516 SUSE bug 1173489 SUSE bug 1178658 SUSE bug 1201457 SUSE bug 1201877 SUSE bug 1203236 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access. Important CVE-2017-5731 SUSE bug 1115917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none. Moderate CVE-2017-5732 SUSE bug 1115917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none. Moderate CVE-2017-5733 SUSE bug 1115917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. Moderate CVE-2017-5734 SUSE bug 1115917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none. Moderate CVE-2017-5735 SUSE bug 1115917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Important CVE-2017-5753 SUSE bug 1068032 SUSE bug 1074562 SUSE bug 1074578 SUSE bug 1074701 SUSE bug 1075006 SUSE bug 1075419 SUSE bug 1075748 SUSE bug 1080039 SUSE bug 1087084 SUSE bug 1087939 SUSE bug 1089055 SUSE bug 1136865 SUSE bug 1178658 SUSE bug 1201877 SUSE bug 1209547 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. Important CVE-2017-5754 SUSE bug 1068032 SUSE bug 1074562 SUSE bug 1074578 SUSE bug 1074701 SUSE bug 1075006 SUSE bug 1075008 SUSE bug 1087939 SUSE bug 1089055 SUSE bug 1115045 SUSE bug 1136865 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file. Low CVE-2017-5837 SUSE bug 1023259 SUSE bug 1024076 SUSE bug 1024079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string. Moderate CVE-2017-5838 SUSE bug 1023259 SUSE bug 1024051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX. Low CVE-2017-5839 SUSE bug 1023259 SUSE bug 1024047 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index. Low CVE-2017-5840 SUSE bug 1023259 SUSE bug 1024034 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags. Low CVE-2017-5841 SUSE bug 1023259 SUSE bug 1024030 SUSE bug 1024062 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi. Low CVE-2017-5842 SUSE bug 1023259 SUSE bug 1024041 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf. Low CVE-2017-5843 SUSE bug 1023259 SUSE bug 1024044 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file. Low CVE-2017-5844 SUSE bug 1023259 SUSE bug 1024079 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag. Low CVE-2017-5845 SUSE bug 1023259 SUSE bug 1024062 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file. Moderate CVE-2017-5846 SUSE bug 1023259 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors. Moderate CVE-2017-5847 SUSE bug 1023259 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing. Low CVE-2017-5848 SUSE bug 1023259 SUSE bug 1024068 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb. Low CVE-2017-5856 SUSE bug 1023053 SUSE bug 1024186 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand. Low CVE-2017-5857 SUSE bug 1023073 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access. Moderate CVE-2017-5897 SUSE bug 1023762 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit. Low CVE-2017-5898 SUSE bug 1023907 SUSE bug 1024307 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow. Important CVE-2017-5931 SUSE bug 1024114 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command. Moderate CVE-2017-5937 SUSE bug 1024232 SUSE bug 1041089 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file. Moderate CVE-2017-5950 SUSE bug 1032144 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow. Important CVE-2017-5953 SUSE bug 1024724 SUSE bug 1123143 SUSE bug 1173534 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the vrend_decode_set_framebuffer_state function in vrend_decode.c in virglrenderer before 926b9b3460a48f6454d8bbe9e44313d86a65447f, as used in Quick Emulator (QEMU), allows a local guest users to cause a denial of service (application crash) via the "nr_cbufs" argument. Moderate CVE-2017-5957 SUSE bug 1024993 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.c. Low CVE-2017-5967 SUSE bug 1025209 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser." Moderate CVE-2017-5969 SUSE bug 1024989 SUSE bug 1123919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code. Important CVE-2017-5972 SUSE bug 1026173 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence. Low CVE-2017-5973 SUSE bug 1025109 SUSE bug 1025188 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state. Moderate CVE-2017-5986 SUSE bug 1025235 SUSE bug 1027066 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer. Low CVE-2017-5987 SUSE bug 1025311 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the vrend_renderer_init_blit_ctx function in vrend_blitter.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_CCMD_BLIT commands. Low CVE-2017-5993 SUSE bug 1025505 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and crash) via the num_elements parameter. Low CVE-2017-5994 SUSE bug 1025507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786. Moderate CVE-2017-6001 SUSE bug 1015160 SUSE bug 1025626 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression. Important CVE-2017-6004 SUSE bug 1025709 SUSE bug 1191803 SUSE bug 1193384 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping. Important CVE-2017-6058 SUSE bug 1025837 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call. Important CVE-2017-6074 SUSE bug 1026024 SUSE bug 1072204 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations. Low CVE-2017-6312 SUSE bug 1027024 SUSE bug 1027026 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file. Moderate CVE-2017-6313 SUSE bug 1027024 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls. Moderate CVE-2017-6345 SUSE bug 1027179 SUSE bug 1027190 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices. Moderate CVE-2017-6348 SUSE bug 1027178 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows. Moderate CVE-2017-6349 SUSE bug 1027057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows. Moderate CVE-2017-6350 SUSE bug 1027053 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986. Moderate CVE-2017-6353 SUSE bug 1025235 SUSE bug 1027066 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands. Low CVE-2017-6386 SUSE bug 1027376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. Important CVE-2017-6419 SUSE bug 1052449 SUSE bug 1083915 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330. Low CVE-2017-6505 SUSE bug 1028184 SUSE bug 1028235 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic. Moderate CVE-2017-6507 SUSE bug 1029696 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic. Moderate CVE-2017-6512 SUSE bug 1042218 SUSE bug 1047178 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts. Moderate CVE-2017-6874 SUSE bug 1029314 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility. Moderate CVE-2017-6891 SUSE bug 1040621 SUSE bug 1149679 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type. Moderate CVE-2017-6951 SUSE bug 1029850 SUSE bug 1030593 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. Moderate CVE-2017-7186 SUSE bug 1030066 SUSE bug 1037164 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function. Moderate CVE-2017-7187 SUSE bug 1027179 SUSE bug 1030213 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file. Moderate CVE-2017-7244 SUSE bug 1030807 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file. Moderate CVE-2017-7245 SUSE bug 1030805 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file. Moderate CVE-2017-7246 SUSE bug 1030803 SUSE bug 1030805 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report. Moderate CVE-2017-7273 SUSE bug 1031240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system. Important CVE-2017-7435 SUSE bug 1009127 SUSE bug 1038984 SUSE bug 1045735 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system. Important CVE-2017-7436 SUSE bug 1008325 SUSE bug 1009127 SUSE bug 1038984 SUSE bug 1045735 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. Low CVE-2017-7468 SUSE bug 1033413 SUSE bug 1033442 SUSE bug 1042181 SUSE bug 991389 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host. Moderate CVE-2017-7471 SUSE bug 1034866 SUSE bug 1034990 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls. Moderate CVE-2017-7472 SUSE bug 1034862 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. Moderate CVE-2017-7475 SUSE bug 1036789 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c. Moderate CVE-2017-7476 SUSE bug 1036636 SUSE bug 1037124 SUSE bug 1037125 SUSE bug 1037142 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation. Moderate CVE-2017-7482 SUSE bug 1046107 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface. Moderate CVE-2017-7487 SUSE bug 1038879 SUSE bug 1038883 SUSE bug 1038981 SUSE bug 1038982 SUSE bug 1072204 SUSE bug 1115893 SUSE bug 870618 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest. Important CVE-2017-7493 SUSE bug 1039495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. Important CVE-2017-7494 SUSE bug 1038231 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file. Moderate CVE-2017-7495 SUSE bug 1039010 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege. Important CVE-2017-7500 SUSE bug 1126909 SUSE bug 1135195 SUSE bug 1157882 SUSE bug 1157883 SUSE bug 943457 SUSE bug 964063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation. Important CVE-2017-7501 SUSE bug 1119217 SUSE bug 1126909 SUSE bug 1135195 SUSE bug 1157882 SUSE bug 1157883 SUSE bug 943457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this. Moderate CVE-2017-7518 SUSE bug 1045922 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used. Low CVE-2017-7526 SUSE bug 1046607 SUSE bug 1047462 SUSE bug 1123792 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket. Moderate CVE-2017-7542 SUSE bug 1049882 SUSE bug 1061936 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution. Moderate CVE-2017-7555 SUSE bug 1054171 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Important CVE-2017-7592 SUSE bug 1033131 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image. Moderate CVE-2017-7593 SUSE bug 1033129 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image. Moderate CVE-2017-7594 SUSE bug 1033128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. Moderate CVE-2017-7595 SUSE bug 1033111 SUSE bug 1033127 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Important CVE-2017-7596 SUSE bug 1033112 SUSE bug 1033113 SUSE bug 1033120 SUSE bug 1033126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Moderate CVE-2017-7597 SUSE bug 1033112 SUSE bug 1033113 SUSE bug 1033120 SUSE bug 1033126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. Moderate CVE-2017-7598 SUSE bug 1033118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Moderate CVE-2017-7599 SUSE bug 1033112 SUSE bug 1033113 SUSE bug 1033120 SUSE bug 1033126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Low CVE-2017-7600 SUSE bug 1033112 SUSE bug 1033113 SUSE bug 1033120 SUSE bug 1033126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Low CVE-2017-7601 SUSE bug 1033111 SUSE bug 1033127 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Moderate CVE-2017-7602 SUSE bug 1033109 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Moderate CVE-2017-7607 SUSE bug 1033084 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7608 SUSE bug 1033085 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file. Low CVE-2017-7609 SUSE bug 1033086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7610 SUSE bug 1033087 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7611 SUSE bug 1033088 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7612 SUSE bug 1033089 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file. Low CVE-2017-7613 SUSE bug 1033090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. Important CVE-2017-7645 SUSE bug 1034670 SUSE bug 1036741 SUSE bug 1046191 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10. Critical CVE-2017-7869 SUSE bug 1034173 SUSE bug 1038337 SUSE bug 1149679 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c. Moderate CVE-2017-7889 SUSE bug 1034405 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file. Moderate CVE-2017-7960 SUSE bug 1034481 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components." Low CVE-2017-7961 SUSE bug 1034482 SUSE bug 1132069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation. Moderate CVE-2017-7980 SUSE bug 1035406 SUSE bug 1035483 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c. Moderate CVE-2017-8105 SUSE bug 1034186 SUSE bug 1035807 SUSE bug 1036457 SUSE bug 1079459 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer. Low CVE-2017-8106 SUSE bug 1035877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count. Low CVE-2017-8112 SUSE bug 1036211 SUSE bug 1036470 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. Important CVE-2017-8287 SUSE bug 1034186 SUSE bug 1035807 SUSE bug 1036457 SUSE bug 1079459 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture. Low CVE-2017-8309 SUSE bug 1037242 SUSE bug 1037243 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events. Low CVE-2017-8379 SUSE bug 1037334 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors. Low CVE-2017-8380 SUSE bug 1037336 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb. Important CVE-2017-8779 SUSE bug 1037559 SUSE bug 1037930 SUSE bug 1101814 SUSE bug 798028 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression. Low CVE-2017-8786 SUSE bug 1036942 SUSE bug 1037718 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system. Important CVE-2017-8797 SUSE bug 1046202 SUSE bug 1046206 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-8831. Reason: This candidate is a duplicate of CVE-2017-8831. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2017-8831 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2017-8813 SUSE bug 1070849 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields. Moderate CVE-2017-8816 SUSE bug 1069226 SUSE bug 1106019 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character. Moderate CVE-2017-8817 SUSE bug 1069222 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library. Critical CVE-2017-8818 SUSE bug 1069714 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state. Important CVE-2017-8824 SUSE bug 1070771 SUSE bug 1076734 SUSE bug 1092904 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability. Moderate CVE-2017-8831 SUSE bug 1037994 SUSE bug 1061936 SUSE bug 1087082 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file. Low CVE-2017-8834 SUSE bug 1043898 SUSE bug 1043899 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file. Low CVE-2017-8871 SUSE bug 1043898 SUSE bug 1043899 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. Important CVE-2017-8890 SUSE bug 1038544 SUSE bug 1038564 SUSE bug 1039883 SUSE bug 1039885 SUSE bug 1040069 SUSE bug 1042364 SUSE bug 1051906 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling. Low CVE-2017-8925 SUSE bug 1037183 SUSE bug 1038981 SUSE bug 1038982 SUSE bug 870618 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash. Moderate CVE-2017-9047 SUSE bug 1039063 SUSE bug 1039066 SUSE bug 1039657 SUSE bug 1123919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash. Moderate CVE-2017-9048 SUSE bug 1039064 SUSE bug 1039066 SUSE bug 1039658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. Important CVE-2017-9049 SUSE bug 1039063 SUSE bug 1039064 SUSE bug 1039066 SUSE bug 1039659 SUSE bug 1039661 SUSE bug 1069690 SUSE bug 1123919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Important CVE-2017-9075 SUSE bug 1038544 SUSE bug 1039883 SUSE bug 1051906 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Important CVE-2017-9076 SUSE bug 1038544 SUSE bug 1039885 SUSE bug 1040069 SUSE bug 1051906 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Important CVE-2017-9077 SUSE bug 1038544 SUSE bug 1040069 SUSE bug 1042364 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition. Moderate CVE-2017-9229 SUSE bug 1068376 SUSE bug 1069631 SUSE bug 1069632 SUSE bug 1076391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. Important CVE-2017-9233 SUSE bug 1030296 SUSE bug 1047236 SUSE bug 1073350 SUSE bug 1123115 SUSE bug 983216 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls. Important CVE-2017-9242 SUSE bug 1041431 SUSE bug 1042892 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content. Important CVE-2017-9269 SUSE bug 1038984 SUSE bug 1045735 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used. Moderate CVE-2017-9271 SUSE bug 1050625 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505. Low CVE-2017-9330 SUSE bug 1042159 SUSE bug 1042160 SUSE bug 1043157 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file. Low CVE-2017-9403 SUSE bug 1042805 SUSE bug 1045688 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file. Low CVE-2017-9404 SUSE bug 1042804 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it. Important CVE-2017-9445 SUSE bug 1045290 SUSE bug 1063249 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://"). Moderate CVE-2017-9502 SUSE bug 1044243 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing. Low CVE-2017-9503 SUSE bug 1043296 SUSE bug 1043297 SUSE bug 1043312 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function. Moderate CVE-2017-9524 SUSE bug 1043808 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file. NOTE: Maintainer asserts the issue is due to a bug in downstream code caused by misuse of the libjpeg API. Important CVE-2017-9614 SUSE bug 1050231 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call. Low CVE-2017-9814 SUSE bug 1049092 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution. Important CVE-2017-9935 SUSE bug 1046077 SUSE bug 1074318 SUSE bug 1108606 SUSE bug 1110358 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack. Moderate CVE-2017-9936 SUSE bug 1046073 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability. Moderate CVE-2017-9984 SUSE bug 1046599 SUSE bug 1087082 SUSE bug 187396 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability. Moderate CVE-2017-9985 SUSE bug 1046601 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability. Moderate CVE-2017-9986 SUSE bug 1046600 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. Moderate CVE-2018-0495 SUSE bug 1097410 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value). Important CVE-2018-0500 SUSE bug 1099793 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o). Important CVE-2018-0732 SUSE bug 1077628 SUSE bug 1097158 SUSE bug 1099502 SUSE bug 1106692 SUSE bug 1108542 SUSE bug 1110163 SUSE bug 1112097 SUSE bug 1122198 SUSE bug 1148697 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p). Moderate CVE-2018-0734 SUSE bug 1113534 SUSE bug 1113652 SUSE bug 1113742 SUSE bug 1122198 SUSE bug 1122212 SUSE bug 1126909 SUSE bug 1148697 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Moderate CVE-2018-0735 SUSE bug 1113534 SUSE bug 1113651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o). Moderate CVE-2018-0737 SUSE bug 1089039 SUSE bug 1089041 SUSE bug 1089044 SUSE bug 1089045 SUSE bug 1108542 SUSE bug 1123780 SUSE bug 1126909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). Important CVE-2018-0739 SUSE bug 1087102 SUSE bug 1089997 SUSE bug 1094291 SUSE bug 1108542 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Important CVE-2018-1000001 SUSE bug 1074293 SUSE bug 1099047 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition. Moderate CVE-2018-1000004 SUSE bug 1076017 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something. Critical CVE-2018-1000005 SUSE bug 1076360 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request. Moderate CVE-2018-1000007 SUSE bug 1077001 SUSE bug 1145903 SUSE bug 1185551 SUSE bug 1192797 SUSE bug 1198766 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM.. Important CVE-2018-1000026 SUSE bug 1079384 SUSE bug 1087082 SUSE bug 1096723 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE. Important CVE-2018-1000030 SUSE bug 1079300 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. Moderate CVE-2018-1000120 SUSE bug 1084521 SUSE bug 1101811 SUSE bug 1112526 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service Low CVE-2018-1000121 SUSE bug 1084524 SUSE bug 1085215 SUSE bug 1101811 SUSE bug 1112526 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage Moderate CVE-2018-1000122 SUSE bug 1084532 SUSE bug 1101811 SUSE bug 1112526 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time. Moderate CVE-2018-1000135 SUSE bug 1086263 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1. Moderate CVE-2018-1000168 SUSE bug 1088639 SUSE bug 1097401 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit." Moderate CVE-2018-1000204 SUSE bug 1096728 SUSE bug 1105412 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0. Critical CVE-2018-1000300 SUSE bug 1092094 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0. Critical CVE-2018-1000301 SUSE bug 1092098 SUSE bug 1122464 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file. Moderate CVE-2018-1000654 SUSE bug 1105435 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace. Moderate CVE-2018-1000802 SUSE bug 1109663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0. Important CVE-2018-1000807 SUSE bug 1111634 SUSE bug 1111635 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0. Moderate CVE-2018-1000808 SUSE bug 1111634 SUSE bug 1111635 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultID: CVE-2017-6519. Reason: This candidate is a duplicate of CVE-2017-6519. Notes: All CVE users should reference CVE-2017-6519 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2018-1000845 SUSE bug 1120281 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060. Moderate CVE-2018-1000858 SUSE bug 1120346 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the relevance of this report because the failure can only occur for physically proximate attackers who unplug SAS Host Bus Adapter cables. Moderate CVE-2018-10021 SUSE bug 1087082 SUSE bug 1089281 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value. Low CVE-2018-10087 SUSE bug 1087082 SUSE bug 1089608 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image. Moderate CVE-2018-10322 SUSE bug 1087082 SUSE bug 1090749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image. Moderate CVE-2018-10323 SUSE bug 1087082 SUSE bug 1090717 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file. Low CVE-2018-10360 SUSE bug 1096974 SUSE bug 1096984 SUSE bug 1126118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file. Moderate CVE-2018-10392 SUSE bug 1091070 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read. Moderate CVE-2018-10393 SUSE bug 1091072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754. Moderate CVE-2018-10471 SUSE bug 1089635 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot. Moderate CVE-2018-10472 SUSE bug 1089152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash. Moderate CVE-2018-1050 SUSE bug 1081741 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers). Important CVE-2018-1057 SUSE bug 1081024 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. Low CVE-2018-1060 SUSE bug 1088009 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service. Moderate CVE-2018-1061 SUSE bug 1088004 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11. Moderate CVE-2018-1063 SUSE bug 1083624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent. Moderate CVE-2018-1064 SUSE bug 1076500 SUSE bug 1083625 SUSE bug 1087887 SUSE bug 1088147 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c. Moderate CVE-2018-1065 SUSE bug 1083650 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls. Moderate CVE-2018-10675 SUSE bug 1087082 SUSE bug 1091755 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. Low CVE-2018-10779 SUSE bug 1092480 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS. Moderate CVE-2018-10839 SUSE bug 1110910 SUSE bug 1110924 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image. Moderate CVE-2018-10840 SUSE bug 1087082 SUSE bug 1094669 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets. Moderate CVE-2018-10844 SUSE bug 1105437 SUSE bug 1105459 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets. Moderate CVE-2018-10845 SUSE bug 1105437 SUSE bug 1105459 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets. Moderate CVE-2018-10846 SUSE bug 1105460 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3. Moderate CVE-2018-10852 SUSE bug 1098377 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest. Important CVE-2018-10853 SUSE bug 1097104 SUSE bug 1097108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container. Moderate CVE-2018-10856 SUSE bug 1097970 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable. Moderate CVE-2018-10858 SUSE bug 1103411 SUSE bug 1110943 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected. Important CVE-2018-10861 SUSE bug 1099162 SUSE bug 1114710 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts. Important CVE-2018-10873 SUSE bug 1104448 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. Moderate CVE-2018-10878 SUSE bug 1087082 SUSE bug 1099813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. Moderate CVE-2018-10880 SUSE bug 1087082 SUSE bug 1099845 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. Moderate CVE-2018-10882 SUSE bug 1087082 SUSE bug 1099849 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness. Moderate CVE-2018-10892 SUSE bug 1100331 SUSE bug 1100838 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. Moderate CVE-2018-10893 SUSE bug 1101295 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. Moderate CVE-2018-10902 SUSE bug 1105322 SUSE bug 1105323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage. Important CVE-2018-10903 SUSE bug 1101820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects. Moderate CVE-2018-10906 SUSE bug 1101797 SUSE bug 1127346 SUSE bug 1127350 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service. Moderate CVE-2018-1091 SUSE bug 1087231 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable. Moderate CVE-2018-10918 SUSE bug 1103414 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable. Moderate CVE-2018-10919 SUSE bug 1095057 SUSE bug 1110943 SUSE bug 1209485 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image. Moderate CVE-2018-1092 SUSE bug 1087012 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers. Moderate CVE-2018-1093 SUSE bug 1087082 SUSE bug 1087095 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal. Moderate CVE-2018-10932 SUSE bug 1104624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access. Critical CVE-2018-10933 SUSE bug 1108020 SUSE bug 1122198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system before an attacker could leverage this flaw. Important CVE-2018-10938 SUSE bug 1106016 SUSE bug 1106191 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image. Moderate CVE-2018-1094 SUSE bug 1087007 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image. Moderate CVE-2018-1095 SUSE bug 1087004 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726. Moderate CVE-2018-10963 SUSE bug 1092949 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request. Moderate CVE-2018-10981 SUSE bug 1090823 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection. Important CVE-2018-10982 SUSE bug 1090822 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. Moderate CVE-2018-1108 SUSE bug 1087082 SUSE bug 1090818 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure. Low CVE-2018-1116 SUSE bug 1099031 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file. Moderate CVE-2018-1118 SUSE bug 1087082 SUSE bug 1092472 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks). Low CVE-2018-1120 SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function. CVE-2018-1122 SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service). CVE-2018-1123 SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution. Important CVE-2018-11236 SUSE bug 1094161 SUSE bug 1110160 SUSE bug 1118435 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper. Moderate CVE-2018-11237 SUSE bug 1092877 SUSE bug 1094154 SUSE bug 1118435 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users. CVE-2018-1124 SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash. CVE-2018-1125 SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124. CVE-2018-1126 SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. Important CVE-2018-1128 SUSE bug 1096748 SUSE bug 1114710 SUSE bug 1177843 SUSE bug 1177859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. Important CVE-2018-1129 SUSE bug 1096748 SUSE bug 1114710 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls. Moderate CVE-2018-1130 SUSE bug 1092904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. Moderate CVE-2018-1139 SUSE bug 1095048 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable Important CVE-2018-1140 SUSE bug 1095056 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode. Moderate CVE-2018-11412 SUSE bug 1087082 SUSE bug 1094678 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call. Moderate CVE-2018-11506 SUSE bug 1087082 SUSE bug 1094835 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image. Moderate CVE-2018-1152 SUSE bug 1098155 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. Moderate CVE-2018-11806 SUSE bug 1096223 SUSE bug 1096224 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF. Moderate CVE-2018-11813 SUSE bug 1096209 SUSE bug 1172994 SUSE bug 1172995 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name. Low CVE-2018-12015 SUSE bug 1096718 SUSE bug 1099497 SUSE bug 1099507 SUSE bug 1106717 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes. Important CVE-2018-12020 SUSE bug 1096745 SUSE bug 1101134 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2018-12126 SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1135409 SUSE bug 1135524 SUSE bug 1137916 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1149725 SUSE bug 1149726 SUSE bug 1149729 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2018-12127 SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1135409 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2018-12130 SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1135409 SUSE bug 1137916 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network. Critical CVE-2018-12178 SUSE bug 1127821 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access. Important CVE-2018-12180 SUSE bug 1127820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access. Moderate CVE-2018-12181 SUSE bug 1128503 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. Moderate CVE-2018-12207 SUSE bug 1117665 SUSE bug 1139073 SUSE bug 1152505 SUSE bug 1155812 SUSE bug 1155817 SUSE bug 1155945 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash. CVE-2018-12232 SUSE bug 1087082 SUSE bug 1097593 SUSE bug 1125907 SUSE bug 1127757 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr. Moderate CVE-2018-12233 SUSE bug 1087082 SUSE bug 1097234 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3. Moderate CVE-2018-12384 SUSE bug 1106873 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41. Moderate CVE-2018-12404 SUSE bug 1119069 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Important CVE-2018-12405 SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 64. Important CVE-2018-12406 SUSE bug 1112111 SUSE bug 1119105 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. This vulnerability affects Firefox < 64. Important CVE-2018-12407 SUSE bug 1112111 SUSE bug 1119105 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket. Moderate CVE-2018-12617 SUSE bug 1098735 SUSE bug 1098744 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86 HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability. Important CVE-2018-12891 SUSE bug 1097521 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line. Important CVE-2018-12892 SUSE bug 1097523 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users. Important CVE-2018-12893 SUSE bug 1097522 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls. Low CVE-2018-12896 SUSE bug 1099922 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file. Moderate CVE-2018-12900 SUSE bug 1099257 SUSE bug 1125113 SUSE bug 1150480 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL. Important CVE-2018-12904 SUSE bug 1087082 SUSE bug 1099183 SUSE bug 1099258 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. Low CVE-2018-12910 SUSE bug 1100097 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem. Moderate CVE-2018-12928 SUSE bug 1099613 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem. Important CVE-2018-12930 SUSE bug 1099619 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. Low CVE-2018-13053 SUSE bug 1099924 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation. Moderate CVE-2018-13093 SUSE bug 1100001 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. Moderate CVE-2018-13094 SUSE bug 1087082 SUSE bug 1100000 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork. Moderate CVE-2018-13095 SUSE bug 1099999 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID. Moderate CVE-2018-13405 SUSE bug 1087082 SUSE bug 1100416 SUSE bug 1129735 SUSE bug 1195161 SUSE bug 1198702 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service. Low CVE-2018-13785 SUSE bug 1100687 SUSE bug 1112153 SUSE bug 1116574 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. Moderate CVE-2018-14404 SUSE bug 1102046 SUSE bug 1148896 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries. Low CVE-2018-14498 SUSE bug 1128712 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information. Moderate CVE-2018-14526 SUSE bug 1104205 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251. Moderate CVE-2018-14567 SUSE bug 1088279 SUSE bug 1088601 SUSE bug 1105166 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault). Moderate CVE-2018-14598 SUSE bug 1102073 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact. Moderate CVE-2018-14599 SUSE bug 1102062 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution. Important CVE-2018-14600 SUSE bug 1102068 SUSE bug 1178417 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc rb_trees when reloc control has not been initialized. Moderate CVE-2018-14609 SUSE bug 1102875 SUSE bug 1103597 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in fs/btrfs/extent-tree.c. Moderate CVE-2018-14610 SUSE bug 1102877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in btrfs_check_chunk_valid in fs/btrfs/volumes.c. Moderate CVE-2018-14611 SUSE bug 1102879 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in check_leaf in fs/btrfs/tree-checker.c. Moderate CVE-2018-14612 SUSE bug 1102882 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item validation in check_leaf_item in fs/btrfs/tree-checker.c. Moderate CVE-2018-14613 SUSE bug 1102896 SUSE bug 1103800 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.) Moderate CVE-2018-14618 SUSE bug 1106019 SUSE bug 1112758 SUSE bug 1122464 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service. Moderate CVE-2018-14629 SUSE bug 1116319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable. Important CVE-2018-14633 SUSE bug 1107829 SUSE bug 1107832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable. Important CVE-2018-14634 SUSE bug 1108912 SUSE bug 1108963 SUSE bug 1115893 SUSE bug 1120323 SUSE bug 1122265 SUSE bug 1188063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15. Moderate CVE-2018-14647 SUSE bug 1109847 SUSE bug 1126909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges. Moderate CVE-2018-14678 SUSE bug 1102715 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash). Moderate CVE-2018-14679 SUSE bug 1102922 SUSE bug 1103032 SUSE bug 1103040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite. Moderate CVE-2018-14681 SUSE bug 1102922 SUSE bug 1103032 SUSE bug 1103040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Moderate CVE-2018-14682 SUSE bug 1102922 SUSE bug 1103032 SUSE bug 1103040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in evaluate_auto_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. Code execution as root can occur via a specially crafted filesystem label if btrfs-{scrub,balance,trim} are set to auto in /etc/sysconfig/btrfsmaintenance (this is not the default, though). Moderate CVE-2018-14722 SUSE bug 1102721 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free). Moderate CVE-2018-14734 SUSE bug 1103119 SUSE bug 1131390 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences. Moderate CVE-2018-15120 SUSE bug 1103877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service. Moderate CVE-2018-15468 SUSE bug 1103276 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash). Moderate CVE-2018-15469 SUSE bug 1103275 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not specified. In practice, different implementations behave differently. Thus, oxenstored may not enforce the configured quota-maxentity. This allows a malicious or buggy guest to write as many xenstore entries as it wishes, causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Moderate CVE-2018-15470 SUSE bug 1103279 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks. Important CVE-2018-15572 SUSE bug 1102517 SUSE bug 1105296 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. Moderate CVE-2018-15594 SUSE bug 1105348 SUSE bug 1133319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot). Moderate CVE-2018-15664 SUSE bug 1096726 SUSE bug 1139649 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239. Moderate CVE-2018-15686 SUSE bug 1113665 SUSE bug 1120323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239. Moderate CVE-2018-15687 SUSE bug 1113666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239. Important CVE-2018-15688 SUSE bug 1113632 SUSE bug 1113668 SUSE bug 1113669 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread. Moderate CVE-2018-15746 SUSE bug 1106222 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server. Important CVE-2018-15750 SUSE bug 1113698 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). Critical CVE-2018-15751 SUSE bug 1113698 SUSE bug 1113699 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation. Low CVE-2018-15853 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly. Low CVE-2018-15854 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled. Low CVE-2018-15855 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files. Low CVE-2018-15856 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file. Low CVE-2018-15857 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file. Low CVE-2018-15858 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled. Low CVE-2018-15859 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure. Low CVE-2018-15861 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers. Low CVE-2018-15862 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression. Low CVE-2018-15863 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created. Low CVE-2018-15864 SUSE bug 1105832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog. Important CVE-2018-15869 SUSE bug 1105988 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file. Moderate CVE-2018-16062 SUSE bug 1106390 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges. Important CVE-2018-16276 SUSE bug 1106095 SUSE bug 1115593 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump. Important CVE-2018-16301 SUSE bug 1153098 SUSE bug 1153332 SUSE bug 1195825 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209. Moderate CVE-2018-16335 SUSE bug 1106853 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16391 SUSE bug 1106998 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16392 SUSE bug 1106999 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16393 SUSE bug 1108318 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice. Moderate CVE-2018-16402 SUSE bug 1107066 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash. Low CVE-2018-16403 SUSE bug 1107067 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16418 SUSE bug 1107039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16419 SUSE bug 1107107 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16420 SUSE bug 1107097 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16421 SUSE bug 1107049 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16422 SUSE bug 1107038 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16423 SUSE bug 1107037 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16424 SUSE bug 1107036 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16425 SUSE bug 1107035 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs. Moderate CVE-2018-16426 SUSE bug 1107034 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs. Moderate CVE-2018-16427 SUSE bug 1107033 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Low CVE-2018-16428 SUSE bug 1107121 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str(). Low CVE-2018-16429 SUSE bug 1107116 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. Moderate CVE-2018-16435 SUSE bug 1108813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem. Moderate CVE-2018-16597 SUSE bug 1106512 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. Moderate CVE-2018-16838 SUSE bug 1124194 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. Moderate CVE-2018-16839 SUSE bug 1112758 SUSE bug 1113029 SUSE bug 1131886 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Moderate CVE-2018-16840 SUSE bug 1112758 SUSE bug 1113029 SUSE bug 1122464 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process. Moderate CVE-2018-16841 SUSE bug 1116320 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. Moderate CVE-2018-16842 SUSE bug 1113660 SUSE bug 1122464 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices. Moderate CVE-2018-16846 SUSE bug 1114710 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process. Moderate CVE-2018-16847 SUSE bug 1114529 SUSE bug 1114540 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service. Moderate CVE-2018-16851 SUSE bug 1116322 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service. Moderate CVE-2018-16852 SUSE bug 1116321 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command. Moderate CVE-2018-16853 SUSE bug 1116324 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade. Important CVE-2018-16857 SUSE bug 1116323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal. Important CVE-2018-16860 SUSE bug 1134024 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable. Important CVE-2018-16864 SUSE bug 1108912 SUSE bug 1120323 SUSE bug 1122265 SUSE bug 1188063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable. Important CVE-2018-16865 SUSE bug 1108912 SUSE bug 1120323 SUSE bug 1122265 SUSE bug 1188063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server. Moderate CVE-2018-16868 SUSE bug 1117951 SUSE bug 1118087 SUSE bug 1134856 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server. Moderate CVE-2018-16869 SUSE bug 1117951 SUSE bug 1118086 SUSE bug 1118087 SUSE bug 1134856 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS. Moderate CVE-2018-16872 SUSE bug 1119493 SUSE bug 1119494 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u". Important CVE-2018-16873 SUSE bug 1118897 SUSE bug 1118898 SUSE bug 1118899 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution. Moderate CVE-2018-16874 SUSE bug 1118897 SUSE bug 1118898 SUSE bug 1118899 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected. Moderate CVE-2018-16875 SUSE bug 1118897 SUSE bug 1118898 SUSE bug 1118899 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable. Moderate CVE-2018-16880 SUSE bug 1122767 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Important CVE-2018-16884 SUSE bug 1119946 SUSE bug 1119947 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable. Moderate CVE-2018-16889 SUSE bug 1121567 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. Low CVE-2018-16890 SUSE bug 1123371 SUSE bug 1123378 SUSE bug 1141798 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp. Low CVE-2018-17000 SUSE bug 1108606 SUSE bug 1115717 SUSE bug 1125113 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. Low CVE-2018-17100 SUSE bug 1108637 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. Low CVE-2018-17101 SUSE bug 1108627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Important CVE-2018-17466 SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The function t2p_write_pdf in tiff2pdf.c in LibTIFF 4.0.9 and earlier allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935. Moderate CVE-2018-17795 SUSE bug 1046077 SUSE bug 1110358 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open). Important CVE-2018-17953 SUSE bug 1115640 SUSE bug 1197654 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. Moderate CVE-2018-17958 SUSE bug 1111006 SUSE bug 1111007 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used. Moderate CVE-2018-17962 SUSE bug 1111010 SUSE bug 1111011 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. Moderate CVE-2018-17963 SUSE bug 1111013 SUSE bug 1111014 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which allows local users to cause a denial of service (memory consumption and system hang) by leveraging root access to execute crafted applications, as demonstrated on CentOS 7. Moderate CVE-2018-17977 SUSE bug 1111609 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function). Important CVE-2018-18064 SUSE bug 1111329 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. Moderate CVE-2018-18074 SUSE bug 1111622 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes. Low CVE-2018-18310 SUSE bug 1111973 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Important CVE-2018-18311 SUSE bug 1114674 SUSE bug 1132018 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Moderate CVE-2018-18312 SUSE bug 1114675 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory. Moderate CVE-2018-18313 SUSE bug 1114681 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Moderate CVE-2018-18314 SUSE bug 1114686 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ. Moderate CVE-2018-18386 SUSE bug 1094825 SUSE bug 1112039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value. Moderate CVE-2018-18438 SUSE bug 1112185 SUSE bug 1112188 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts. Low CVE-2018-18445 SUSE bug 1112372 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Important CVE-2018-18492 SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Important CVE-2018-18493 SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Important CVE-2018-18494 SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64. Important CVE-2018-18495 SUSE bug 1112111 SUSE bug 1119105 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability affects Firefox < 64. Important CVE-2018-18496 SUSE bug 1119105 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64. Important CVE-2018-18497 SUSE bug 1112111 SUSE bug 1119105 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Important CVE-2018-18498 SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service. Moderate CVE-2018-18508 SUSE bug 1124571 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file. Low CVE-2018-18520 SUSE bug 1112726 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled. Low CVE-2018-18521 SUSE bug 1112723 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write. Moderate CVE-2018-18557 SUSE bug 1113094 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control. Important CVE-2018-18559 SUSE bug 1112859 SUSE bug 1112921 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write. Moderate CVE-2018-18584 SUSE bug 1113038 SUSE bug 1113039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name). Moderate CVE-2018-18585 SUSE bug 1113038 SUSE bug 1113039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application. Moderate CVE-2018-18586 SUSE bug 1113038 SUSE bug 1113039 SUSE bug 1113040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. Low CVE-2018-18661 SUSE bug 1113672 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value. Moderate CVE-2018-18849 SUSE bug 1114422 SUSE bug 1114423 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted. Moderate CVE-2018-18883 SUSE bug 1114405 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset. Low CVE-2018-19210 SUSE bug 1108606 SUSE bug 1115717 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection. Moderate CVE-2018-19211 SUSE bug 1115929 SUSE bug 1131830 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized. Moderate CVE-2018-19407 SUSE bug 1116841 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf. Low CVE-2018-19416 SUSE bug 1117001 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf. Low CVE-2018-19517 SUSE bug 1117260 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection Important CVE-2018-19637 SUSE bug 1063385 SUSE bug 1117776 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files. Low CVE-2018-19638 SUSE bug 1063385 SUSE bug 1118460 SUSE bug 1118462 SUSE bug 1118463 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root. Important CVE-2018-19639 SUSE bug 1063385 SUSE bug 1118460 SUSE bug 1118462 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local machine. Moderate CVE-2018-19640 SUSE bug 1063385 SUSE bug 1118463 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command. Moderate CVE-2018-19788 SUSE bug 1118274 SUSE bug 1118277 SUSE bug 1119056 SUSE bug 1126909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c. Moderate CVE-2018-19824 SUSE bug 1118152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes. Important CVE-2018-19961 SUSE bug 1115040 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones. Important CVE-2018-19962 SUSE bug 1115040 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled. Important CVE-2018-19963 SUSE bug 1115043 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions. Moderate CVE-2018-19964 SUSE bug 1115044 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation. Moderate CVE-2018-19965 SUSE bug 1115045 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595. Moderate CVE-2018-19966 SUSE bug 1115047 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix. Moderate CVE-2018-19967 SUSE bug 1114988 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. Low CVE-2018-20060 SUSE bug 1119376 SUSE bug 1216275 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error. Low CVE-2018-20123 SUSE bug 1119437 SUSE bug 1119438 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value. Moderate CVE-2018-20124 SUSE bug 1119840 SUSE bug 1119841 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings. Important CVE-2018-20125 SUSE bug 1119989 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. Low CVE-2018-20126 SUSE bug 1119991 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference). Important CVE-2018-20191 SUSE bug 1119979 SUSE bug 1119980 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled). Important CVE-2018-20216 SUSE bug 1119984 SUSE bug 1119985 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request. Moderate CVE-2018-20217 SUSE bug 1120489 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan. Important CVE-2018-20346 SUSE bug 1119687 SUSE bug 1120335 SUSE bug 1131576 SUSE bug 1131918 SUSE bug 1131919 SUSE bug 1148893 SUSE bug 1169664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. Low CVE-2018-20406 SUSE bug 1120644 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root). Moderate CVE-2018-20482 SUSE bug 1120610 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call. Low CVE-2018-20511 SUSE bug 1120388 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service. Moderate CVE-2018-20532 SUSE bug 1120629 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service. Moderate CVE-2018-20533 SUSE bug 1120630 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application. Low CVE-2018-20534 SUSE bug 1120631 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file. Moderate CVE-2018-20573 SUSE bug 1121227 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file. Moderate CVE-2018-20574 SUSE bug 1121230 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation. Important CVE-2018-20669 SUSE bug 1122971 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. Important CVE-2018-20685 SUSE bug 1121571 SUSE bug 1123220 SUSE bug 1131109 SUSE bug 1134932 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. Moderate CVE-2018-20699 SUSE bug 1121768 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load. Moderate CVE-2018-20784 SUSE bug 1126703 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep. Moderate CVE-2018-20796 SUSE bug 1127311 SUSE bug 1182116 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk. Moderate CVE-2018-20815 SUSE bug 1118900 SUSE bug 1130675 SUSE bug 1130680 SUSE bug 1138043 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. Moderate CVE-2018-20836 SUSE bug 1134395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks). Moderate CVE-2018-20843 SUSE bug 1139937 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. Moderate CVE-2018-20852 SUSE bug 1141853 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace. Moderate CVE-2018-20855 SUSE bug 1143045 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled. Moderate CVE-2018-20856 SUSE bug 1143048 SUSE bug 1156331 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure. Moderate CVE-2018-20976 SUSE bug 1146285 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c. Moderate CVE-2018-21008 SUSE bug 1149591 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent). Critical CVE-2018-21029 SUSE bug 1155539 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8. Important CVE-2018-25015 SUSE bug 1187046 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c. Important CVE-2018-25020 SUSE bug 1193575 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Important CVE-2018-25032 SUSE bug 1197459 SUSE bug 1197893 SUSE bug 1198667 SUSE bug 1199104 SUSE bug 1200049 SUSE bug 1201732 SUSE bug 1202688 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. Moderate CVE-2018-3613 SUSE bug 1115916 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none. Important CVE-2018-3630 SUSE bug 1127822 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. Moderate CVE-2018-3639 SUSE bug 1074701 SUSE bug 1085235 SUSE bug 1085308 SUSE bug 1087078 SUSE bug 1087082 SUSE bug 1092631 SUSE bug 1092885 SUSE bug 1094912 SUSE bug 1098813 SUSE bug 1100394 SUSE bug 1102640 SUSE bug 1105412 SUSE bug 1111963 SUSE bug 1172781 SUSE bug 1172782 SUSE bug 1172783 SUSE bug 1173489 SUSE bug 1178658 SUSE bug 1201877 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a. Moderate CVE-2018-3640 SUSE bug 1074701 SUSE bug 1087078 SUSE bug 1087083 SUSE bug 1094912 SUSE bug 1098813 SUSE bug 1100394 SUSE bug 1115893 SUSE bug 1175912 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. Important CVE-2018-3646 SUSE bug 1087078 SUSE bug 1087081 SUSE bug 1089343 SUSE bug 1091107 SUSE bug 1099306 SUSE bug 1104365 SUSE bug 1104894 SUSE bug 1106548 SUSE bug 1113534 SUSE bug 1136865 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. Moderate CVE-2018-3665 SUSE bug 1087078 SUSE bug 1087082 SUSE bug 1087086 SUSE bug 1090338 SUSE bug 1095241 SUSE bug 1095242 SUSE bug 1096740 SUSE bug 1100091 SUSE bug 1100555 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not properly ensure constant execution time. Moderate CVE-2018-3691 SUSE bug 1087082 SUSE bug 1087086 SUSE bug 1090338 SUSE bug 1095241 SUSE bug 1095242 SUSE bug 1096740 SUSE bug 1115633 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. Important CVE-2018-4180 SUSE bug 1096405 SUSE bug 1096408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. Moderate CVE-2018-4181 SUSE bug 1096406 SUSE bug 1096408 SUSE bug 1105281 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS. Moderate CVE-2018-4182 SUSE bug 1096407 SUSE bug 1096408 SUSE bug 1105281 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions. Moderate CVE-2018-4183 SUSE bug 1096407 SUSE bug 1096408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2018-4700 SUSE bug 1115750 SUSE bug 1131480 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7. Important CVE-2018-5146 SUSE bug 1085671 SUSE bug 1085687 SUSE bug 1180395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a vcpu is destroyed. This allows guest OS administrators to cause a denial of service (host OS memory consumption) by rebooting many times. Low CVE-2018-5244 SUSE bug 1073961 SUSE bug 1074966 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c). Low CVE-2018-5332 SUSE bug 1075621 SUSE bug 1091815 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference. Low CVE-2018-5333 SUSE bug 1075617 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact. Moderate CVE-2018-5344 SUSE bug 1075825 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service. Important CVE-2018-5390 SUSE bug 1087082 SUSE bug 1102340 SUSE bug 1102682 SUSE bug 1103097 SUSE bug 1103098 SUSE bug 1156434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via vectors involving TLS. Important CVE-2018-5703 SUSE bug 1076200 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. Moderate CVE-2018-5729 SUSE bug 1076211 SUSE bug 1083926 SUSE bug 1122468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. Moderate CVE-2018-5730 SUSE bug 1076211 SUSE bug 1083927 SUSE bug 1122468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. Low CVE-2018-5748 SUSE bug 1076500 SUSE bug 1083625 SUSE bug 1087887 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an SBS HC printk call. Low CVE-2018-5750 SUSE bug 1077892 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism. Low CVE-2018-5764 SUSE bug 1076503 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries. Moderate CVE-2018-5784 SUSE bug 1081690 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash. Moderate CVE-2018-5803 SUSE bug 1083900 SUSE bug 1087082 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05. Moderate CVE-2018-5873 SUSE bug 1100490 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "software IO TLB" printk call. Low CVE-2018-5953 SUSE bug 1104131 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS. Important CVE-2018-6003 SUSE bug 1076832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption. Moderate CVE-2018-6485 SUSE bug 1079036 SUSE bug 1123874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption. Moderate CVE-2018-6551 SUSE bug 1079036 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket. Low CVE-2018-6554 SUSE bug 1106509 SUSE bug 1106511 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket. Moderate CVE-2018-6555 SUSE bug 1106509 SUSE bug 1106511 SUSE bug 1115893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value. Moderate CVE-2018-6927 SUSE bug 1080757 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file. Moderate CVE-2018-6942 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on. Important CVE-2018-6954 SUSE bug 1080919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. Moderate CVE-2018-7169 SUSE bug 1081294 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR. Low CVE-2018-7273 SUSE bug 1081972 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.) Moderate CVE-2018-7456 SUSE bug 1074317 SUSE bug 1082825 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure. Moderate CVE-2018-7480 SUSE bug 1082863 SUSE bug 1084536 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetable freeing. Moderate CVE-2018-7540 SUSE bug 1080635 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.10.x allowing guest OS users to cause a denial of service (hypervisor crash) or gain privileges by triggering a grant-table transition from v2 to v1. Important CVE-2018-7541 SUSE bug 1080662 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC. Important CVE-2018-7542 SUSE bug 1080634 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access. Important CVE-2018-7550 SUSE bug 1083291 SUSE bug 1083292 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user. Important CVE-2018-7566 SUSE bug 1083483 SUSE bug 1083488 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download. Important CVE-2018-7685 SUSE bug 1045735 SUSE bug 1088705 SUSE bug 1091624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR. Low CVE-2018-7755 SUSE bug 1084513 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file. Moderate CVE-2018-7757 SUSE bug 1084536 SUSE bug 1087082 SUSE bug 1087209 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display. Moderate CVE-2018-7858 SUSE bug 1084604 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory. NOTE: a third party has indicated that this report is not security relevant. Moderate CVE-2018-7995 SUSE bug 1084755 SUSE bug 1087082 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file. Moderate CVE-2018-7999 SUSE bug 1084850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c. Low CVE-2018-8740 SUSE bug 1085790 SUSE bug 1131919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 elfutils 0.170 has a buffer over-read in the ebl_dynamic_tag_name function of libebl/ebldynamictagname.c because SYMTAB_SHNDX is unsupported. Moderate CVE-2018-8769 SUSE bug 1085809 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space. Important CVE-2018-8781 SUSE bug 1087082 SUSE bug 1090643 SUSE bug 1090646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code. Moderate CVE-2018-8822 SUSE bug 1086162 SUSE bug 1090404 SUSE bug 1091815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. Important CVE-2018-8897 SUSE bug 1087078 SUSE bug 1087088 SUSE bug 1090368 SUSE bug 1090820 SUSE bug 1090869 SUSE bug 1092497 SUSE bug 1093522 SUSE bug 1093524 SUSE bug 1098813 SUSE bug 1100835 SUSE bug 1115893 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps. Moderate CVE-2018-8905 SUSE bug 1086408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on the directional branch predictor, as demonstrated by a pattern history table (PHT), aka BranchScope. Moderate CVE-2018-9056 SUSE bug 1087110 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. Important CVE-2018-9234 SUSE bug 1088255 SUSE bug 1090647 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035. Low CVE-2018-9251 SUSE bug 1088279 SUSE bug 1088601 SUSE bug 1105166 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. Low CVE-2018-9517 SUSE bug 1108488 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel. Important CVE-2018-9568 SUSE bug 1118319 SUSE bug 1118320 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an authenticated user to potentially enable denial of service via local access. Important CVE-2019-0154 SUSE bug 1135966 SUSE bug 1181720 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of privilege via local access. Important CVE-2019-0155 SUSE bug 1135966 SUSE bug 1135967 SUSE bug 1173663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access. Moderate CVE-2019-0160 SUSE bug 1130267 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access. Moderate CVE-2019-0161 SUSE bug 1131361 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'. Low CVE-2019-0804 SUSE bug 1127838 SUSE bug 1152980 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d. Low CVE-2019-1010305 SUSE bug 1141680 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free. Critical CVE-2019-10125 SUSE bug 1130695 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. Important CVE-2019-10132 SUSE bug 1134348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects. Important CVE-2019-10142 SUSE bug 1135955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container. Important CVE-2019-10152 SUSE bug 1136974 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application. Critical CVE-2019-10160 SUSE bug 1138459 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. Important CVE-2019-10161 SUSE bug 1138301 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. Important CVE-2019-10166 SUSE bug 1138302 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Important CVE-2019-10167 SUSE bug 1138303 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Important CVE-2019-10168 SUSE bug 1138305 SUSE bug 1138582 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release. Low CVE-2019-10183 SUSE bug 1140211 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share. Important CVE-2019-10197 SUSE bug 1141267 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash. Moderate CVE-2019-10207 SUSE bug 1123959 SUSE bug 1142857 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens. Important CVE-2019-10214 SUSE bug 1144065 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. Moderate CVE-2019-10218 SUSE bug 1144902 SUSE bug 1144903 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. Important CVE-2019-10220 SUSE bug 1144903 SUSE bug 1153108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients. Important CVE-2019-10222 SUSE bug 1139399 SUSE bug 1145093 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. Moderate CVE-2019-10638 SUSE bug 1140575 SUSE bug 1140577 SUSE bug 1142129 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. Important CVE-2019-10906 SUSE bug 1132323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. Moderate CVE-2019-11068 SUSE bug 1132160 SUSE bug 1154212 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2019-11091 SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1133319 SUSE bug 1135394 SUSE bug 1138043 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access. Moderate CVE-2019-11098 SUSE bug 1188371 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. Moderate CVE-2019-11135 SUSE bug 1139073 SUSE bug 1152497 SUSE bug 1152505 SUSE bug 1152506 SUSE bug 1160120 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access. Moderate CVE-2019-11139 SUSE bug 1141035 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. Moderate CVE-2019-11236 SUSE bug 1129071 SUSE bug 1132663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. Low CVE-2019-11324 SUSE bug 1132900 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff. Important CVE-2019-11477 SUSE bug 1132686 SUSE bug 1137586 SUSE bug 1142129 SUSE bug 1153242 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e. Important CVE-2019-11478 SUSE bug 1132686 SUSE bug 1137586 SUSE bug 1142129 SUSE bug 1143542 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363. Important CVE-2019-11479 SUSE bug 1132686 SUSE bug 1137586 SUSE bug 1142129 SUSE bug 1143542 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c. Moderate CVE-2019-11555 SUSE bug 1133640 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. Moderate CVE-2019-11599 SUSE bug 1131645 SUSE bug 1133738 SUSE bug 1157905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Important CVE-2019-11745 SUSE bug 1158328 SUSE bug 1158527 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11757 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11758 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11759 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11760 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11761 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11762 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11763 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11764 SUSE bug 1154738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free. Low CVE-2019-11810 SUSE bug 1134399 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. Low CVE-2019-11811 SUSE bug 1134397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. Moderate CVE-2019-11833 SUSE bug 1135281 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character. Low CVE-2019-11884 SUSE bug 1134848 SUSE bug 1139868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used. Low CVE-2019-11922 SUSE bug 1142941 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null. Low CVE-2019-12067 SUSE bug 1145642 SUSE bug 1145652 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well. Moderate CVE-2019-12068 SUSE bug 1146873 SUSE bug 1146874 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. Low CVE-2019-12155 SUSE bug 1135902 SUSE bug 1135905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated. Moderate CVE-2019-12290 SUSE bug 1154884 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An issue was discovered in con_insert_unipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. There is a memory leak in a certain case of an ENOMEM outcome of kmalloc. NOTE: This id is disputed as not being an issue. Low CVE-2019-12379 SUSE bug 1136602 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 **DISPUTED** An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because “All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it.”. Low CVE-2019-12380 SUSE bug 1136598 SUSE bug 1155298 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management server (dnsserver) RPC server process. Moderate CVE-2019-12435 SUSE bug 1137815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit. Moderate CVE-2019-12436 SUSE bug 1137816 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. Important CVE-2019-12450 SUSE bug 1137001 SUSE bug 1139959 SUSE bug 1142126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked kstrndup of derived_name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This id is disputed as not being an issue because “The memory allocation that was not checked is part of a code that only runs at boot time, before user processes are started. Therefore, there is no possibility for an unprivileged user to control it, and no denial of service.”. Moderate CVE-2019-12455 SUSE bug 1136946 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a "double fetch" vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used. Important CVE-2019-12456 SUSE bug 1136922 SUSE bug 1136993 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). Moderate CVE-2019-12614 SUSE bug 1137194 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Important CVE-2019-12735 SUSE bug 1137443 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass. Important CVE-2019-12749 SUSE bug 1137832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected. Important CVE-2019-12817 SUSE bug 1138263 SUSE bug 1138264 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c. Moderate CVE-2019-12818 SUSE bug 1138293 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. Important CVE-2019-12900 SUSE bug 1139083 SUSE bug 1141513 SUSE bug 1149458 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack. Moderate CVE-2019-12904 SUSE bug 1138939 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11884. Reason: This candidate is a reservation duplicate of CVE-2019-11884. Notes: All CVE users should reference CVE-2019-11884 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Low CVE-2019-12983 SUSE bug 1134848 SUSE bug 1139868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack. Moderate CVE-2019-13050 SUSE bug 1141093 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.) Moderate CVE-2019-13057 SUSE bug 1143273 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855. Moderate CVE-2019-13115 SUSE bug 1141850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character. Moderate CVE-2019-13117 SUSE bug 1140095 SUSE bug 1157028 SUSE bug 1160968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data. Low CVE-2019-13118 SUSE bug 1140101 SUSE bug 1157028 SUSE bug 1160968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations. Important CVE-2019-13132 SUSE bug 1140255 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass. Moderate CVE-2019-13164 SUSE bug 1140402 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust. Moderate CVE-2019-13224 SUSE bug 1142847 SUSE bug 1203568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments. Important CVE-2019-13272 SUSE bug 1140671 SUSE bug 1156321 SUSE bug 1198122 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line. Low CVE-2019-13313 SUSE bug 1140749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery. Moderate CVE-2019-13377 SUSE bug 1144443 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret. Moderate CVE-2019-13509 SUSE bug 1142160 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user. Moderate CVE-2019-13565 SUSE bug 1143194 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7. Moderate CVE-2019-13627 SUSE bug 1148987 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container. Important CVE-2019-14271 SUSE bug 1143409 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. Moderate CVE-2019-14283 SUSE bug 1143191 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. Moderate CVE-2019-14287 SUSE bug 1153674 SUSE bug 1156093 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. Important CVE-2019-14378 SUSE bug 1143794 SUSE bug 1143797 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491. Moderate CVE-2019-14513 SUSE bug 1143944 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access. Important CVE-2019-14553 SUSE bug 1153072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access. Moderate CVE-2019-14559 SUSE bug 1163927 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none. Moderate CVE-2019-14560 SUSE bug 1174246 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access. Low CVE-2019-14562 SUSE bug 1175476 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. Moderate CVE-2019-14563 SUSE bug 1163959 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. Important CVE-2019-14575 SUSE bug 1163969 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access. Low CVE-2019-14584 SUSE bug 1177789 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access. Moderate CVE-2019-14615 SUSE bug 1160195 SUSE bug 1165881 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code. Important CVE-2019-14814 SUSE bug 1146512 SUSE bug 1173664 SUSE bug 1173665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver. Important CVE-2019-14815 SUSE bug 1146514 SUSE bug 1173665 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code. Important CVE-2019-14816 SUSE bug 1146516 SUSE bug 1173666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system. Moderate CVE-2019-14821 SUSE bug 1151350 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks. Moderate CVE-2019-14833 SUSE bug 1154289 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation. Moderate CVE-2019-14834 SUSE bug 1154849 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue. Moderate CVE-2019-14847 SUSE bug 1154598 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. Moderate CVE-2019-14855 SUSE bug 1157900 SUSE bug 1160243 SUSE bug 1181233 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer. Moderate CVE-2019-14861 SUSE bug 1158108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system. Moderate CVE-2019-14866 SUSE bug 1155199 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set. Moderate CVE-2019-14870 SUSE bug 1158109 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target. Important CVE-2019-14889 SUSE bug 1158095 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code. Important CVE-2019-14895 SUSE bug 1157042 SUSE bug 1157158 SUSE bug 1173100 SUSE bug 1173660 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP. Important CVE-2019-14896 SUSE bug 1157157 SUSE bug 1160468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA. Important CVE-2019-14897 SUSE bug 1157155 SUSE bug 1160467 SUSE bug 1160468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system. Important CVE-2019-14901 SUSE bug 1157042 SUSE bug 1173661 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers. Moderate CVE-2019-14902 SUSE bug 1160850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless). Moderate CVE-2019-14907 SUSE bug 1160888 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash. Moderate CVE-2019-14973 SUSE bug 1146608 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check. Moderate CVE-2019-15030 SUSE bug 1149713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c. Moderate CVE-2019-15031 SUSE bug 1149713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. Moderate CVE-2019-15098 SUSE bug 1146378 SUSE bug 1146543 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. Moderate CVE-2019-15099 SUSE bug 1146368 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory access. Important CVE-2019-15117 SUSE bug 1145920 SUSE bug 1173934 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open up an attack vector involving extra data at the end of a request. Moderate CVE-2019-15161 SUSE bug 1153332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames. Moderate CVE-2019-15162 SUSE bug 1153332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. Moderate CVE-2019-15163 SUSE bug 1153332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Moderate CVE-2019-15164 SUSE bug 1153332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Moderate CVE-2019-15165 SUSE bug 1153332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver. Moderate CVE-2019-15212 SUSE bug 1146391 SUSE bug 1146519 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver. Moderate CVE-2019-15213 SUSE bug 1146519 SUSE bug 1146544 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c. Low CVE-2019-15214 SUSE bug 1146519 SUSE bug 1146550 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver. Moderate CVE-2019-15217 SUSE bug 1146519 SUSE bug 1146547 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver. Moderate CVE-2019-15218 SUSE bug 1146413 SUSE bug 1146519 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver. Moderate CVE-2019-15219 SUSE bug 1146519 SUSE bug 1146524 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver. Moderate CVE-2019-15220 SUSE bug 1146519 SUSE bug 1146526 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.2.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/helper.c (motu_microbookii) driver. Moderate CVE-2019-15222 SUSE bug 1146519 SUSE bug 1146531 SUSE bug 1158381 SUSE bug 1158398 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-15098. Reason: This candidate is a duplicate of CVE-2019-15098. Notes: All CVE users should reference CVE-2019-15098 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2019-15290 SUSE bug 1146378 SUSE bug 1146519 SUSE bug 1146543 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver. Moderate CVE-2019-15291 SUSE bug 1146519 SUSE bug 1146540 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c. Important CVE-2019-15292 SUSE bug 1146678 SUSE bug 1173939 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j). Low CVE-2019-1543 SUSE bug 1128189 SUSE bug 1141801 SUSE bug 1154162 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). Moderate CVE-2019-1547 SUSE bug 1150003 SUSE bug 1154162 SUSE bug 1154166 SUSE bug 1156430 SUSE bug 1161085 SUSE bug 1205621 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Moderate CVE-2019-1549 SUSE bug 1150247 SUSE bug 1154162 SUSE bug 1205621 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir). Important CVE-2019-15504 SUSE bug 1147116 SUSE bug 1185852 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir). Moderate CVE-2019-15505 SUSE bug 1147122 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). Moderate CVE-2019-1551 SUSE bug 1158809 SUSE bug 1205621 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). Low CVE-2019-1559 SUSE bug 1127080 SUSE bug 1130039 SUSE bug 1141798 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). Moderate CVE-2019-1563 SUSE bug 1150250 SUSE bug 1154162 SUSE bug 1156430 SUSE bug 1205621 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation. Important CVE-2019-15666 SUSE bug 1148394 SUSE bug 1172140 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow. Important CVE-2019-15794 SUSE bug 1158156 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Moderate CVE-2019-15890 SUSE bug 1149811 SUSE bug 1149813 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. Important CVE-2019-15903 SUSE bug 1149429 SUSE bug 1154738 SUSE bug 1154806 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service. Low CVE-2019-15916 SUSE bug 1149448 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.11. fm10k_init_module in drivers/net/ethernet/intel/fm10k/fm10k_main.c has a NULL pointer dereference because there is no -ENOMEM upon an alloc_workqueue failure. Low CVE-2019-15924 SUSE bug 1149612 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c. Important CVE-2019-15925 SUSE bug 1149532 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in the file drivers/net/wireless/ath/ath6kl/wmi.c. Moderate CVE-2019-15926 SUSE bug 1149527 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c. Moderate CVE-2019-15927 SUSE bug 1149522 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c. Moderate CVE-2019-15945 SUSE bug 1149746 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c. Moderate CVE-2019-15946 SUSE bug 1149747 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally. Moderate CVE-2019-16056 SUSE bug 1149955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value. Low CVE-2019-16089 SUSE bug 1150004 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. Low CVE-2019-16163 SUSE bug 1150130 SUSE bug 1203568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c. Low CVE-2019-16167 SUSE bug 1150114 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." Moderate CVE-2019-16168 SUSE bug 1150137 SUSE bug 1160968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: The security community disputes this issues as not being serious enough to be deserving a CVE id. Low CVE-2019-16229 SUSE bug 1150469 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: A third-party software maintainer states that the work queue allocation is happening during device initialization, which for a graphics card occurs during boot. It is not attacker controllable and OOM at that time is highly unlikely. Low CVE-2019-16230 SUSE bug 1150466 SUSE bug 1150468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Low CVE-2019-16231 SUSE bug 1150466 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Low CVE-2019-16232 SUSE bug 1150465 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Low CVE-2019-16233 SUSE bug 1150457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Low CVE-2019-16234 SUSE bug 1150452 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range. Moderate CVE-2019-16275 SUSE bug 1150934 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems. Moderate CVE-2019-16413 SUSE bug 1151347 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow. Important CVE-2019-16746 SUSE bug 1152107 SUSE bug 1173659 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory. Moderate CVE-2019-16884 SUSE bug 1152308 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. Moderate CVE-2019-16935 SUSE bug 1153238 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a. Moderate CVE-2019-16994 SUSE bug 1161523 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d. Moderate CVE-2019-16995 SUSE bug 1152685 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow. Moderate CVE-2019-17006 SUSE bug 1159819 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance. Moderate CVE-2019-17075 SUSE bug 1152790 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow. Important CVE-2019-17133 SUSE bug 1153158 SUSE bug 1153161 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels). Important CVE-2019-17347 SUSE bug 1126201 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation. Moderate CVE-2019-17349 SUSE bug 1138294 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. Important CVE-2019-17361 SUSE bug 1162504 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. Moderate CVE-2019-17498 SUSE bug 1154862 SUSE bug 1171566 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk." Important CVE-2019-17543 SUSE bug 1153936 SUSE bug 1188549 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition. Important CVE-2019-17546 SUSE bug 1154365 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. Low CVE-2019-17594 SUSE bug 1154036 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. Low CVE-2019-17595 SUSE bug 1154037 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. Moderate CVE-2019-17666 SUSE bug 1154372 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. Important CVE-2019-18197 SUSE bug 1154609 SUSE bug 1157028 SUSE bug 1162833 SUSE bug 1169511 SUSE bug 1190108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753. Moderate CVE-2019-18198 SUSE bug 1154617 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). Critical CVE-2019-18218 SUSE bug 1154661 SUSE bug 1190368 SUSE bug 1191838 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string. Moderate CVE-2019-18224 SUSE bug 1154887 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1. Moderate CVE-2019-18348 SUSE bug 1155094 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands. Moderate CVE-2019-18388 SUSE bug 1159479 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Important CVE-2019-18389 SUSE bug 1159482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands. Moderate CVE-2019-18390 SUSE bug 1159478 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Important CVE-2019-18391 SUSE bug 1159486 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat. Important CVE-2019-18397 SUSE bug 1156260 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only target memory assigned to the guest. However, when the guest domain is torn down, or the device is deassigned, the device is assigned back to dom0, thus allowing any in-flight DMA to potentially target critical host data. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable. Important CVE-2019-18424 SUSE bug 1154461 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. Critical CVE-2019-18634 SUSE bug 1162202 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. Moderate CVE-2019-18660 SUSE bug 1157038 SUSE bug 1157923 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free. Moderate CVE-2019-18683 SUSE bug 1155897 SUSE bug 1173868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem. Low CVE-2019-18786 SUSE bug 1156043 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers. Important CVE-2019-18802 SUSE bug 1159003 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. Low CVE-2019-18805 SUSE bug 1156187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247. Moderate CVE-2019-18808 SUSE bug 1156259 SUSE bug 1189884 SUSE bug 1190534 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559. Moderate CVE-2019-18809 SUSE bug 1156258 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1. Moderate CVE-2019-18811 SUSE bug 1159374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef. Moderate CVE-2019-18812 SUSE bug 1156277 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8. Moderate CVE-2019-18813 SUSE bug 1156278 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. Moderate CVE-2019-18814 SUSE bug 1156256 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object. Low CVE-2019-18874 SUSE bug 1156525 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15. Moderate CVE-2019-18885 SUSE bug 1156901 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions. Moderate CVE-2019-18897 SUSE bug 1157465 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1. Moderate CVE-2019-18898 SUSE bug 1154062 SUSE bug 1157651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1. Low CVE-2019-18900 SUSE bug 1158763 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62. Moderate CVE-2019-18902 SUSE bug 1160903 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62. Moderate CVE-2019-18903 SUSE bug 1160904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero. Moderate CVE-2019-19036 SUSE bug 1157692 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero. Moderate CVE-2019-19037 SUSE bug 1157717 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459. Moderate CVE-2019-19043 SUSE bug 1159375 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering kcalloc() or v3d_job_init() failures, aka CID-29cd13cfd762. Moderate CVE-2019-19044 SUSE bug 1159370 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7. Moderate CVE-2019-19045 SUSE bug 1161522 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time. Moderate CVE-2019-19046 SUSE bug 1157304 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_crdump_collect() failures, aka CID-c7ed6d0183d5. Low CVE-2019-19047 SUSE bug 1157715 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864. Important CVE-2019-19048 SUSE bug 1157720 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot. Moderate CVE-2019-19049 SUSE bug 1157173 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_reportstat_alg() failures, aka CID-c03b04dcdba1. Moderate CVE-2019-19050 SUSE bug 1157336 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7. Moderate CVE-2019-19051 SUSE bug 1159024 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-fb5be6a7b486. Moderate CVE-2019-19052 SUSE bug 1157324 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy_from_iter_full() failures, aka CID-bbe692e349e2. Important CVE-2019-19053 SUSE bug 1161520 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b. Moderate CVE-2019-19054 SUSE bug 1161518 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdr_put() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because it occurs on a code path where a successful allocation has already occurred. Important CVE-2019-19055 SUSE bug 1157319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932. Moderate CVE-2019-19056 SUSE bug 1157197 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e. Low CVE-2019-19057 SUSE bug 1157193 SUSE bug 1157197 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures, aka CID-b4b814fec1a5. Moderate CVE-2019-19058 SUSE bug 1157145 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or dma_alloc_coherent() failures, aka CID-0f4f199443fa. Moderate CVE-2019-19059 SUSE bug 1157296 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41. Moderate CVE-2019-19060 SUSE bug 1157178 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3. Moderate CVE-2019-19061 SUSE bug 1157192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. Moderate CVE-2019-19062 SUSE bug 1157333 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113. Moderate CVE-2019-19063 SUSE bug 1157298 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering pm_runtime_get_sync() failures, aka CID-057b8945f78f. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control these failures at probe time. Moderate CVE-2019-19064 SUSE bug 1157300 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e. NOTE: This has been disputed as not a vulnerability because "rhashtable_init() can only fail if it is passed invalid values in the second parameter's struct, but when invoked from sdma_init() that is a pointer to a static const struct, so an attacker could only trigger failure if they could corrupt kernel memory (in which case a small memory leak is not a significant problem)." Important CVE-2019-19065 SUSE bug 1157191 SUSE bug 1173961 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd. Moderate CVE-2019-19066 SUSE bug 1157303 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures, aka CID-57be09c6e874. NOTE: third parties dispute the relevance of this because the attacker must already have privileges for module loading. Moderate CVE-2019-19067 SUSE bug 1157180 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6. Moderate CVE-2019-19068 SUSE bug 1157307 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99. Moderate CVE-2019-19069 SUSE bug 1157064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering devm_add_action_or_reset() failures, aka CID-d3b0ffa1d75d. NOTE: third parties dispute the relevance of this because the system must have already been out of memory before the probe began. Important CVE-2019-19070 SUSE bug 1157294 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c. Moderate CVE-2019-19071 SUSE bug 1157067 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6. Moderate CVE-2019-19072 SUSE bug 1157069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10. Moderate CVE-2019-19073 SUSE bug 1157070 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4. Moderate CVE-2019-19074 SUSE bug 1157143 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e. Low CVE-2019-19075 SUSE bug 1157162 SUSE bug 1173958 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14. Moderate CVE-2019-19077 SUSE bug 1157171 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2. Moderate CVE-2019-19078 SUSE bug 1157032 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a. Moderate CVE-2019-19080 SUSE bug 1157044 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a. Moderate CVE-2019-19081 SUSE bug 1157045 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka CID-104c307147ad. Moderate CVE-2019-19082 SUSE bug 1157046 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects the dce112_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, the dce100_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, the dcn20_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c, the dce120_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, and the dce80_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c, aka CID-055e547478a1. Moderate CVE-2019-19083 SUSE bug 1157049 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program. Low CVE-2019-19126 SUSE bug 1157292 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read. Important CVE-2019-19203 SUSE bug 1164550 SUSE bug 1203568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read. Important CVE-2019-19204 SUSE bug 1164569 SUSE bug 1203568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122. Moderate CVE-2019-19227 SUSE bug 1157678 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context. Important CVE-2019-19241 SUSE bug 1159441 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. Moderate CVE-2019-19244 SUSE bug 1157817 SUSE bug 1157818 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c. Important CVE-2019-19246 SUSE bug 1157805 SUSE bug 1203568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a. Moderate CVE-2019-19252 SUSE bug 1157813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact. Low CVE-2019-19317 SUSE bug 1158812 SUSE bug 1196773 SUSE bug 1196775 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer, Moderate CVE-2019-19318 SUSE bug 1158026 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30. Moderate CVE-2019-19319 SUSE bug 1158021 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service. Moderate CVE-2019-19332 SUSE bug 1158827 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability. Moderate CVE-2019-19338 SUSE bug 1158954 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer. Moderate CVE-2019-19344 SUSE bug 1160852 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c. Important CVE-2019-19377 SUSE bug 1158266 SUSE bug 1162338 SUSE bug 1162369 SUSE bug 1173871 SUSE bug 1211495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/btrfs/raid56.c. Important CVE-2019-19378 SUSE bug 1158270 SUSE bug 1185853 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c. Important CVE-2019-19447 SUSE bug 1158819 SUSE bug 1173869 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure. Important CVE-2019-19448 SUSE bug 1158820 SUSE bug 1162369 SUSE bug 1173871 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated). Important CVE-2019-19449 SUSE bug 1158821 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result. Low CVE-2019-19462 SUSE bug 1158265 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute. Moderate CVE-2019-19479 SUSE bug 1158256 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry. Moderate CVE-2019-19480 SUSE bug 1158307 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79. Moderate CVE-2019-19523 SUSE bug 1158381 SUSE bug 1158823 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. Low CVE-2019-19524 SUSE bug 1158381 SUSE bug 1158413 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035. Moderate CVE-2019-19525 SUSE bug 1158381 SUSE bug 1158417 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098. Moderate CVE-2019-19526 SUSE bug 1158381 SUSE bug 1158834 SUSE bug 1158893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d. Moderate CVE-2019-19528 SUSE bug 1158381 SUSE bug 1158407 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41. Moderate CVE-2019-19529 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef. Moderate CVE-2019-19530 SUSE bug 1158381 SUSE bug 1158410 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c. Moderate CVE-2019-19532 SUSE bug 1158381 SUSE bug 1158823 SUSE bug 1158824 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464. Low CVE-2019-19533 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29. Low CVE-2019-19534 SUSE bug 1158381 SUSE bug 1158398 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0. Low CVE-2019-19536 SUSE bug 1158381 SUSE bug 1158394 SUSE bug 1158834 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. Moderate CVE-2019-19537 SUSE bug 1158381 SUSE bug 1158834 SUSE bug 1158904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment, and libvirt uses its own ways as well. Hosts where these "alternate" methods are used will still leave the system in a vulnerable state after the device comes back from a guest. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable. Moderate CVE-2019-19579 SUSE bug 1157888 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access may occur. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. 32-bit Arm systems are vulnerable. 64-bit Arm systems are not vulnerable. Moderate CVE-2019-19581 SUSE bug 1158003 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. x86 systems with 64 or more nodes are vulnerable (there might not be any such systems that Xen would run on). x86 systems with less than 64 nodes are not vulnerable. Moderate CVE-2019-19582 SUSE bug 1158003 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc. Low CVE-2019-19602 SUSE bug 1158887 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. Important CVE-2019-19603 SUSE bug 1158960 SUSE bug 1193078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. Moderate CVE-2019-19645 SUSE bug 1158958 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. Moderate CVE-2019-19646 SUSE bug 1158959 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c. Important CVE-2019-19725 SUSE bug 1159104 SUSE bug 1201108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163. Moderate CVE-2019-19767 SUSE bug 1159297 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer). Moderate CVE-2019-19768 SUSE bug 1159285 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h). Moderate CVE-2019-19769 SUSE bug 1159280 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace. Moderate CVE-2019-19770 SUSE bug 1159198 SUSE bug 1171295 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring. Important CVE-2019-19807 SUSE bug 1159281 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this. Critical CVE-2019-19814 SUSE bug 1159437 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled. Important CVE-2019-19816 SUSE bug 1159439 SUSE bug 1173871 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. Important CVE-2019-19880 SUSE bug 1159491 SUSE bug 1159715 SUSE bug 1162833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl. Important CVE-2019-19906 SUSE bug 1159635 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) Moderate CVE-2019-19921 SUSE bug 1160452 SUSE bug 1208962 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.) Moderate CVE-2019-19922 SUSE bug 1159717 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results). Moderate CVE-2019-19923 SUSE bug 1160309 SUSE bug 1162833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling. Moderate CVE-2019-19924 SUSE bug 1159850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. Low CVE-2019-19925 SUSE bug 1159847 SUSE bug 1162833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880. Important CVE-2019-19926 SUSE bug 1159491 SUSE bug 1159715 SUSE bug 1162833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c. Low CVE-2019-19947 SUSE bug 1159929 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. Moderate CVE-2019-19956 SUSE bug 1159928 SUSE bug 1191860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind. Moderate CVE-2019-19959 SUSE bug 1160438 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5. Moderate CVE-2019-19965 SUSE bug 1159911 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. Moderate CVE-2019-20054 SUSE bug 1159910 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b. Moderate CVE-2019-20096 SUSE bug 1159908 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. Important CVE-2019-20218 SUSE bug 1160439 SUSE bug 1189840 SUSE bug 1190372 SUSE bug 1192495 SUSE bug 1193078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). Moderate CVE-2019-20367 SUSE bug 1160551 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. Low CVE-2019-20386 SUSE bug 1161436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. Low CVE-2019-20388 SUSE bug 1161521 SUSE bug 1191860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, leading to (for example) a crash that was identified by syzkaller, aka CID-7b09c2d052db. Moderate CVE-2019-20422 SUSE bug 1161897 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. Moderate CVE-2019-20454 SUSE bug 1164384 SUSE bug 1172973 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of ptrace. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-119769499 Important CVE-2019-2054 SUSE bug 1134561 SUSE bug 1181039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. Moderate CVE-2019-20636 SUSE bug 1168075 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check. Moderate CVE-2019-20792 SUSE bug 1170809 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability. Moderate CVE-2019-20795 SUSE bug 1171452 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75. Low CVE-2019-20806 SUSE bug 1172199 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua). Moderate CVE-2019-20807 SUSE bug 1172225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586. Low CVE-2019-20810 SUSE bug 1172458 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c. Moderate CVE-2019-20811 SUSE bug 1172456 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067. Moderate CVE-2019-20812 SUSE bug 1172453 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454. Important CVE-2019-20838 SUSE bug 1172973 SUSE bug 1189526 SUSE bug 1193384 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Moderate CVE-2019-20907 SUSE bug 1174091 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. Moderate CVE-2019-20916 SUSE bug 1176262 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338 Important CVE-2019-2201 SUSE bug 1156402 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue. Important CVE-2019-25044 SUSE bug 1186175 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46. Important CVE-2019-25045 SUSE bug 1187049 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Low CVE-2019-2708 SUSE bug 1174414 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out. Moderate CVE-2019-3016 SUSE bug 1159281 SUSE bug 1161154 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1. Moderate CVE-2019-3459 SUSE bug 1120758 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1. Moderate CVE-2019-3460 SUSE bug 1120758 SUSE bug 1155131 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa. Moderate CVE-2019-3687 SUSE bug 1148788 SUSE bug 1180102 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary Moderate CVE-2019-3688 SUSE bug 1093414 SUSE bug 1149108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system. Important CVE-2019-3689 SUSE bug 1150733 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges. Moderate CVE-2019-3690 SUSE bug 1148336 SUSE bug 1150734 SUSE bug 1157880 SUSE bug 1157883 SUSE bug 1160594 SUSE bug 1160764 SUSE bug 1163922 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. Moderate CVE-2019-3811 SUSE bug 1121759 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. Important CVE-2019-3813 SUSE bug 1122706 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service. Important CVE-2019-3821 SUSE bug 1125080 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. Important CVE-2019-3822 SUSE bug 1123377 SUSE bug 1141798 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Moderate CVE-2019-3823 SUSE bug 1123378 SUSE bug 1126909 SUSE bug 1141798 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service. Moderate CVE-2019-3824 SUSE bug 1125410 SUSE bug 1130703 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected. Moderate CVE-2019-3829 SUSE bug 1130681 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages. Moderate CVE-2019-3836 SUSE bug 1130682 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption. Moderate CVE-2019-3837 SUSE bug 1131430 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any". Moderate CVE-2019-3842 SUSE bug 1132348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled. Moderate CVE-2019-3843 SUSE bug 1133506 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled. Moderate CVE-2019-3844 SUSE bug 1133509 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. Low CVE-2019-3855 SUSE bug 1128471 SUSE bug 1134329 SUSE bug 1135434 SUSE bug 1141850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. Low CVE-2019-3856 SUSE bug 1128472 SUSE bug 1135434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. Low CVE-2019-3857 SUSE bug 1128474 SUSE bug 1135434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Moderate CVE-2019-3858 SUSE bug 1128476 SUSE bug 1135434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Low CVE-2019-3859 SUSE bug 1128480 SUSE bug 1130103 SUSE bug 1135434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Low CVE-2019-3860 SUSE bug 1128481 SUSE bug 1135434 SUSE bug 1136570 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Low CVE-2019-3861 SUSE bug 1128490 SUSE bug 1135434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Low CVE-2019-3862 SUSE bug 1128492 SUSE bug 1135434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error. Low CVE-2019-3863 SUSE bug 1128493 SUSE bug 1130103 SUSE bug 1135434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update. Moderate CVE-2019-3870 SUSE bug 1130703 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable. Moderate CVE-2019-3874 SUSE bug 1129898 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable. Moderate CVE-2019-3880 SUSE bug 1131060 SUSE bug 1139519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable. Moderate CVE-2019-3882 SUSE bug 1131416 SUSE bug 1131427 SUSE bug 1133319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block. Low CVE-2019-3886 SUSE bug 1131595 SUSE bug 1133150 SUSE bug 1138301 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11599. Reason: This candidate is a reservation duplicate of CVE-2019-11599. Notes: All CVE users should reference CVE-2019-11599 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Low CVE-2019-3892 SUSE bug 1131645 SUSE bug 1133738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario. Moderate CVE-2019-3900 SUSE bug 1133374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8. Low CVE-2019-3901 SUSE bug 1132374 SUSE bug 1133106 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver. Moderate CVE-2019-5008 SUSE bug 1133031 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability. Important CVE-2019-5010 SUSE bug 1122191 SUSE bug 1126909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability. Moderate CVE-2019-5068 SUSE bug 1156015 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Moderate CVE-2019-5094 SUSE bug 1152101 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability. Important CVE-2019-5108 SUSE bug 1159912 SUSE bug 1159913 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Moderate CVE-2019-5188 SUSE bug 1160571 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. Moderate CVE-2019-5435 SUSE bug 1135176 SUSE bug 1154162 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Important CVE-2019-5436 SUSE bug 1135170 SUSE bug 1149496 SUSE bug 1154162 SUSE bug 1167096 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Moderate CVE-2019-5481 SUSE bug 1149495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Important CVE-2019-5482 SUSE bug 1149496 SUSE bug 1156634 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. Important CVE-2019-5736 SUSE bug 1121967 SUSE bug 1122185 SUSE bug 1173421 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. Moderate CVE-2019-6109 SUSE bug 1121571 SUSE bug 1121816 SUSE bug 1121818 SUSE bug 1121821 SUSE bug 1138392 SUSE bug 1144902 SUSE bug 1144903 SUSE bug 1148884 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. Moderate CVE-2019-6110 SUSE bug 1121571 SUSE bug 1121816 SUSE bug 1121818 SUSE bug 1121821 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). Moderate CVE-2019-6111 SUSE bug 1121571 SUSE bug 1121816 SUSE bug 1121818 SUSE bug 1121821 SUSE bug 1123028 SUSE bug 1123220 SUSE bug 1131109 SUSE bug 1138392 SUSE bug 1144902 SUSE bug 1144903 SUSE bug 1148884 SUSE bug 1201840 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb. Low CVE-2019-6128 SUSE bug 1121626 SUSE bug 1153715 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c. Moderate CVE-2019-6133 SUSE bug 1070943 SUSE bug 1121826 SUSE bug 1121872 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control). Important CVE-2019-6250 SUSE bug 1121717 SUSE bug 1122012 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file. Moderate CVE-2019-6285 SUSE bug 1122004 SUSE bug 1122021 SUSE bug 1129245 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file. Moderate CVE-2019-6292 SUSE bug 1122021 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic). Important CVE-2019-6454 SUSE bug 1125352 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized. Low CVE-2019-6462 SUSE bug 1122321 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. Low CVE-2019-6502 SUSE bug 1122756 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships. Moderate CVE-2019-6706 SUSE bug 1123043 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. Important CVE-2019-6778 SUSE bug 1123156 SUSE bug 1123157 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf. Low CVE-2019-7146 SUSE bug 1123545 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens." Moderate CVE-2019-7148 SUSE bug 1123687 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm. Moderate CVE-2019-7149 SUSE bug 1123559 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack. Low CVE-2019-7150 SUSE bug 1123685 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks. Important CVE-2019-7308 SUSE bug 1124055 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. Low CVE-2019-7317 SUSE bug 1124211 SUSE bug 1135824 SUSE bug 1141780 SUSE bug 1147021 SUSE bug 1165297 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900. Low CVE-2019-7663 SUSE bug 1125113 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash). Low CVE-2019-7664 SUSE bug 1125008 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes. Low CVE-2019-7665 SUSE bug 1125007 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing. Important CVE-2019-8341 SUSE bug 1125815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code. Important CVE-2019-8675 SUSE bug 1146358 SUSE bug 1168422 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code. Important CVE-2019-8696 SUSE bug 1146358 SUSE bug 1146359 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. In certain configurations, a remote attacker may be able to submit arbitrary print jobs. Low CVE-2019-8842 SUSE bug 1170671 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360. Moderate CVE-2019-8905 SUSE bug 1126117 SUSE bug 1126118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. Moderate CVE-2019-8906 SUSE bug 1126119 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact. Moderate CVE-2019-8907 SUSE bug 1126117 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr. Important CVE-2019-8912 SUSE bug 1125907 SUSE bug 1126284 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest. Low CVE-2019-8934 SUSE bug 1118900 SUSE bug 1126455 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory. Important CVE-2019-8956 SUSE bug 1124136 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper. Important CVE-2019-9162 SUSE bug 1127324 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. Moderate CVE-2019-9169 SUSE bug 1127308 SUSE bug 1146392 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-14634. Reason: This candidate is a reservation duplicate of CVE-2018-14634. Notes: All CVE users should reference CVE-2018-14634 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2019-9457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected. Important CVE-2019-9494 SUSE bug 1131291 SUSE bug 1131868 SUSE bug 1194732 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected. Moderate CVE-2019-9495 SUSE bug 1131291 SUSE bug 1131870 SUSE bug 1194733 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected. Low CVE-2019-9497 SUSE bug 1131871 SUSE bug 1131872 SUSE bug 1131874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected. Important CVE-2019-9498 SUSE bug 1131871 SUSE bug 1131872 SUSE bug 1131874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected. Important CVE-2019-9499 SUSE bug 1131871 SUSE bug 1131872 SUSE bug 1131874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. Important CVE-2019-9511 SUSE bug 1145579 SUSE bug 1146091 SUSE bug 1146182 SUSE bug 1193427 SUSE bug 1202787 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. Important CVE-2019-9512 SUSE bug 1145663 SUSE bug 1146099 SUSE bug 1146111 SUSE bug 1147142 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. Important CVE-2019-9513 SUSE bug 1145580 SUSE bug 1146094 SUSE bug 1146184 SUSE bug 1193427 SUSE bug 1202787 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. Important CVE-2019-9636 SUSE bug 1129346 SUSE bug 1135433 SUSE bug 1138459 SUSE bug 1145004 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Moderate CVE-2019-9674 SUSE bug 1162825 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. Moderate CVE-2019-9740 SUSE bug 1129071 SUSE bug 1130840 SUSE bug 1132663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. Low CVE-2019-9824 SUSE bug 1118900 SUSE bug 1129622 SUSE bug 1129623 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation. Moderate CVE-2019-9836 SUSE bug 1139383 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations. Moderate CVE-2019-9893 SUSE bug 1128828 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. Low CVE-2019-9923 SUSE bug 1130496 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution. Important CVE-2019-9928 SUSE bug 1133375 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c. Low CVE-2019-9936 SUSE bug 1130326 SUSE bug 1154162 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c. Low CVE-2019-9937 SUSE bug 1130325 SUSE bug 1154162 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. Moderate CVE-2019-9947 SUSE bug 1130840 SUSE bug 1136184 SUSE bug 1155094 SUSE bug 1201559 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In psi_write of psi.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-148159562References: Upstream kernel Important CVE-2020-0110 SUSE bug 1171374 SUSE bug 1174874 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744 Moderate CVE-2020-0305 SUSE bug 1174462 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111893654References: Upstream kernel Moderate CVE-2020-0404 SUSE bug 1176423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171 Moderate CVE-2020-0427 SUSE bug 1176725 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152735806 Moderate CVE-2020-0429 SUSE bug 1176724 SUSE bug 1176931 SUSE bug 1188026 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In skb_headlen of /include/linux/skbuff.h, there is a possible out of bounds read due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-153881554 Important CVE-2020-0430 SUSE bug 1176723 SUSE bug 1178003 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459 Important CVE-2020-0431 SUSE bug 1176722 SUSE bug 1176896 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143560807 Important CVE-2020-0432 SUSE bug 1176721 SUSE bug 1177165 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-14615. Reason: This candidate is a duplicate of CVE-2018-14615. Notes: All CVE users should reference CVE-2018-14615 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2020-0435 SUSE bug 1176719 SUSE bug 1196027 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel Moderate CVE-2020-0444 SUSE bug 1180027 SUSE bug 1180028 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel Important CVE-2020-0465 SUSE bug 1180029 SUSE bug 1180030 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel Important CVE-2020-0466 SUSE bug 1180031 SUSE bug 1180032 SUSE bug 1199255 SUSE bug 1200084 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-0543 SUSE bug 1154824 SUSE bug 1172205 SUSE bug 1172206 SUSE bug 1172207 SUSE bug 1172770 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-0548 SUSE bug 1156353 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-0549 SUSE bug 1156353 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory. Moderate CVE-2020-10001 SUSE bug 1170671 SUSE bug 1180520 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. Low CVE-2020-10029 SUSE bug 1165784 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key. Moderate CVE-2020-10135 SUSE bug 1171988 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Important CVE-2020-10531 SUSE bug 1166844 SUSE bug 1175778 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Moderate CVE-2020-10543 SUSE bug 1171863 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode. Moderate CVE-2020-10690 SUSE bug 1170056 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions. Important CVE-2020-10696 SUSE bug 1167864 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2. Moderate CVE-2020-10700 SUSE bug 1169850 SUSE bug 1173159 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0. Moderate CVE-2020-10701 SUSE bug 1168680 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU. Moderate CVE-2020-10702 SUSE bug 1168681 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2. Important CVE-2020-10704 SUSE bug 1169851 SUSE bug 1170771 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service. Moderate CVE-2020-10711 SUSE bug 1171191 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-10713 SUSE bug 1168994 SUSE bug 1173456 SUSE bug 1173812 SUSE bug 1199353 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the host. Low CVE-2020-10717 SUSE bug 1171110 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-10730 SUSE bug 1173159 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data. Low CVE-2020-10732 SUSE bug 1171220 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. Important CVE-2020-10735 SUSE bug 1203125 SUSE bug 1204077 SUSE bug 1204096 SUSE bug 1204097 SUSE bug 1205075 SUSE bug 1208131 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks. Important CVE-2020-10736 SUSE bug 1170021 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability. Important CVE-2020-10745 SUSE bug 1173160 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container. Moderate CVE-2020-10749 SUSE bug 1172375 SUSE bug 1172410 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing. Moderate CVE-2020-10751 SUSE bug 1171189 SUSE bug 1174963 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1. Moderate CVE-2020-10756 SUSE bug 1172380 SUSE bug 1184743 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system. Important CVE-2020-10757 SUSE bug 1159281 SUSE bug 1172317 SUSE bug 1172437 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba. Moderate CVE-2020-10760 SUSE bug 1173161 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service. Important CVE-2020-10761 SUSE bug 1172710 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality. Moderate CVE-2020-10766 SUSE bug 1159281 SUSE bug 1172781 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality. Moderate CVE-2020-10767 SUSE bug 1159281 SUSE bug 1172782 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality. Moderate CVE-2020-10768 SUSE bug 1159281 SUSE bug 1172783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service. Moderate CVE-2020-10769 SUSE bug 1173265 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data. Low CVE-2020-10773 SUSE bug 1172999 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable. Moderate CVE-2020-10781 SUSE bug 1173074 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. Moderate CVE-2020-10878 SUSE bug 1171864 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls. Moderate CVE-2020-10942 SUSE bug 1167629 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection. Important CVE-2020-11080 SUSE bug 1172441 SUSE bug 1172442 SUSE bug 1181358 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length. Important CVE-2020-11102 SUSE bug 1168713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4. Moderate CVE-2020-11494 SUSE bug 1168424 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol. Important CVE-2020-11501 SUSE bug 1168345 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d. Moderate CVE-2020-11608 SUSE bug 1168829 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. Critical CVE-2020-11651 SUSE bug 1170595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. Critical CVE-2020-11652 SUSE bug 1170595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770. Important CVE-2020-11668 SUSE bug 1168952 SUSE bug 1173942 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Important CVE-2020-11739 SUSE bug 1168142 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed. Important CVE-2020-11740 SUSE bug 1168140 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail pointers in unexpected ways. This can crash the host (DoS). Privilege escalation cannot be ruled out. Important CVE-2020-11741 SUSE bug 1168140 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller without any action taken. In particular, the status fields of individual operations are left uninitialised, and may result in errant behaviour in the caller of GNTTABOP_copy. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to copy a grant, it hits the incorrect exit path. This returns success to the caller without doing anything, which may cause crashes or other incorrect behaviour. Moderate CVE-2020-11742 SUSE bug 1169392 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain. Moderate CVE-2020-11743 SUSE bug 1168143 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service. Moderate CVE-2020-11869 SUSE bug 1170537 SUSE bug 1188609 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur. Moderate CVE-2020-11884 SUSE bug 1170030 SUSE bug 1173947 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients. Moderate CVE-2020-12049 SUSE bug 1172505 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). Important CVE-2020-12243 SUSE bug 1170771 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. Important CVE-2020-12351 SUSE bug 1177724 SUSE bug 1177729 SUSE bug 1178397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. Moderate CVE-2020-12352 SUSE bug 1177725 SUSE bug 1178398 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access. Important CVE-2020-12362 SUSE bug 1181720 SUSE bug 1182033 SUSE bug 1190859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. Low CVE-2020-12363 SUSE bug 1181720 SUSE bug 1181735 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Null pointer reference in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before version Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. Low CVE-2020-12364 SUSE bug 1181720 SUSE bug 1181736 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Expired pointer dereference in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable a denial of service via local access. Low CVE-2020-12373 SUSE bug 1181720 SUSE bug 1181738 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Moderate CVE-2020-12399 SUSE bug 1171978 SUSE bug 1172402 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80. Critical CVE-2020-12400 SUSE bug 1174763 SUSE bug 1175686 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80. Critical CVE-2020-12401 SUSE bug 1174763 SUSE bug 1175686 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78. Moderate CVE-2020-12402 SUSE bug 1173032 SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability. Critical CVE-2020-12403 SUSE bug 1174763 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites. Moderate CVE-2020-12413 SUSE bug 1176332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service. Moderate CVE-2020-12430 SUSE bug 1170765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925. Low CVE-2020-12464 SUSE bug 1170901 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages. Important CVE-2020-12465 SUSE bug 1170828 SUSE bug 1170888 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power." Moderate CVE-2020-12652 SUSE bug 1171218 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea. Important CVE-2020-12653 SUSE bug 1159281 SUSE bug 1171195 SUSE bug 1171254 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591. Important CVE-2020-12654 SUSE bug 1159281 SUSE bug 1171202 SUSE bug 1171252 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767. Low CVE-2020-12655 SUSE bug 1171217 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug. Low CVE-2020-12656 SUSE bug 1171219 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body. Moderate CVE-2020-12657 SUSE bug 1171205 SUSE bug 1201585 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation. Moderate CVE-2020-12659 SUSE bug 1171214 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Moderate CVE-2020-12723 SUSE bug 1171866 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Important CVE-2020-12762 SUSE bug 1171479 SUSE bug 1208644 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8. Low CVE-2020-12769 SUSE bug 1171983 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails. Moderate CVE-2020-12771 SUSE bug 1171732 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption. Important CVE-2020-12825 SUSE bug 1171685 SUSE bug 1203730 SUSE bug 1208647 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space. Moderate CVE-2020-12888 SUSE bug 1159281 SUSE bug 1171868 SUSE bug 1176979 SUSE bug 1179612 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4. Low CVE-2020-13143 SUSE bug 1171982 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process. Low CVE-2020-13253 SUSE bug 1172033 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation. Low CVE-2020-13361 SUSE bug 1172384 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. Low CVE-2020-13362 SUSE bug 1172383 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service. Moderate CVE-2020-13401 SUSE bug 1172375 SUSE bug 1172377 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. Moderate CVE-2020-13434 SUSE bug 1172115 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. Important CVE-2020-13435 SUSE bug 1172091 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server. Moderate CVE-2020-13529 SUSE bug 1185972 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. Moderate CVE-2020-13630 SUSE bug 1172234 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. Moderate CVE-2020-13631 SUSE bug 1172236 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. Moderate CVE-2020-13632 SUSE bug 1172240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host. Moderate CVE-2020-13645 SUSE bug 1172460 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. Moderate CVE-2020-13659 SUSE bug 1172386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. Low CVE-2020-13754 SUSE bug 1172382 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation). Important CVE-2020-13757 SUSE bug 1172389 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. Important CVE-2020-13777 SUSE bug 1172461 SUSE bug 1172506 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file. Moderate CVE-2020-13790 SUSE bug 1172491 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call. Moderate CVE-2020-13800 SUSE bug 1172495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-line speculation." Moderate CVE-2020-13844 SUSE bug 1172798 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case. Moderate CVE-2020-13974 SUSE bug 1172775 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c. Important CVE-2020-13987 SUSE bug 1179907 SUSE bug 1179908 SUSE bug 1193385 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packets in uip_process in net/ipv4/uip.c. Important CVE-2020-13988 SUSE bug 1179907 SUSE bug 1179908 SUSE bug 1193385 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected. Moderate CVE-2020-14145 SUSE bug 1173513 SUSE bug 1177569 SUSE bug 1189078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. Moderate CVE-2020-14155 SUSE bug 1172974 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash. Important CVE-2020-14303 SUSE bug 1173359 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Moderate CVE-2020-14305 SUSE bug 1173346 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process. Moderate CVE-2020-14308 SUSE bug 1168994 SUSE bug 1173812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data. Moderate CVE-2020-14309 SUSE bug 1168994 SUSE bug 1173812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow. Moderate CVE-2020-14310 SUSE bug 1168994 SUSE bug 1173812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow. Moderate CVE-2020-14311 SUSE bug 1168994 SUSE bug 1173812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems. Low CVE-2020-14312 SUSE bug 1173646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability. Low CVE-2020-14314 SUSE bug 1173798 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. Moderate CVE-2020-14318 SUSE bug 1173902 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service. Moderate CVE-2020-14323 SUSE bug 1173994 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-14331 SUSE bug 1174205 SUSE bug 1174247 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2020-14339 SUSE bug 1174458 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges. Moderate CVE-2020-14342 SUSE bug 1174477 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. Important CVE-2020-14343 SUSE bug 1174514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux. Moderate CVE-2020-14344 SUSE bug 1174628 SUSE bug 1174638 SUSE bug 1175880 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Moderate CVE-2020-14351 SUSE bug 1177086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. Moderate CVE-2020-14355 SUSE bug 1177158 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system. Moderate CVE-2020-14356 SUSE bug 1175213 SUSE bug 1176392 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability. Important CVE-2020-14363 SUSE bug 1175239 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. Moderate CVE-2020-14364 SUSE bug 1175441 SUSE bug 1175534 SUSE bug 1176494 SUSE bug 1177130 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal. Moderate CVE-2020-14367 SUSE bug 1174911 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables. Moderate CVE-2020-14370 SUSE bug 1176804 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability. Important CVE-2020-14372 SUSE bug 1175970 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory. Moderate CVE-2020-14382 SUSE bug 1176128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not. Moderate CVE-2020-14383 SUSE bug 1177613 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-14385 SUSE bug 1176137 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity. Important CVE-2020-14386 SUSE bug 1176069 SUSE bug 1176072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4. Important CVE-2020-14387 SUSE bug 1176160 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Important CVE-2020-14390 SUSE bug 1176235 SUSE bug 1176253 SUSE bug 1176278 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service. Low CVE-2020-14394 SUSE bug 1180207 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c. Moderate CVE-2020-14416 SUSE bug 1162002 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2. Important CVE-2020-14422 SUSE bug 1173274 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. Critical CVE-2020-1472 SUSE bug 1176579 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. Moderate CVE-2020-15157 SUSE bug 1177598 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3. Important CVE-2020-15166 SUSE bug 1176116 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container. Important CVE-2020-15257 SUSE bug 1178969 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. Moderate CVE-2020-15358 SUSE bug 1173641 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770. Moderate CVE-2020-15393 SUSE bug 1173514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field. Moderate CVE-2020-15436 SUSE bug 1179141 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p->serial_in pointer which uninitialized. Moderate CVE-2020-15437 SUSE bug 1179140 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host. Xen versions from 4.8 onwards are affected. Xen versions 4.7 and earlier are not affected. Only x86 systems are affected. Arm systems are not affected. Only x86 HVM guests using shadow paging can leverage the vulnerability. In addition, there needs to be an entity actively monitoring a guest's video frame buffer (typically for display purposes) in order for such a guest to be able to leverage the vulnerability. x86 PV guests, as well as x86 HVM guests using hardware assisted paging (HAP), cannot leverage the vulnerability. Moderate CVE-2020-15563 SUSE bug 1173377 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to memory after changes were made. Such writing back of cached data was missing in particular when splitting large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose. Host crashes (leading to a Denial of Service) and privilege escalation cannot be ruled out. Xen versions from at least 3.2 onwards are affected. Only x86 Intel systems are affected. x86 AMD as well as Arm systems are not affected. Only x86 HVM guests using hardware assisted paging (HAP), having a passed through PCI device assigned, and having page table sharing enabled can leverage the vulnerability. Note that page table sharing will be enabled (by default) only if Xen considers IOMMU and CPU large page size support compatible. Important CVE-2020-15565 SUSE bug 1173378 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by the ABI (e.g., 2L or FIFO) used by the guest or the limit set by an administrator (max_event_channels in xl cfg). Due to the missing error checks, only (1) will be considered an error. All the other cases will provide a valid port and will result in a crash when trying to access the event channel. When the administrator configured a guest to allow more than 1023 event channels, that guest may be able to crash the host. When Xen is out-of-memory, allocation of new event channels will result in crashing the host rather than reporting an error. Xen versions 4.10 and later are affected. All architectures are affected. The default configuration, when guests are created with xl/libxl, is not vulnerable, because of the default event-channel limit. Moderate CVE-2020-15566 SUSE bug 1173376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable. Moderate CVE-2020-15567 SUSE bug 1173380 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions. Important CVE-2020-15705 SUSE bug 1174421 SUSE bug 1182890 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions. Moderate CVE-2020-15706 SUSE bug 1174463 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions. Important CVE-2020-15707 SUSE bug 1174570 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code. Important CVE-2020-15708 SUSE bug 1174955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. Moderate CVE-2020-15719 SUSE bug 1174154 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30. Important CVE-2020-15780 SUSE bug 1173573 SUSE bug 1174186 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address. Low CVE-2020-15859 SUSE bug 1174373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555. Important CVE-2020-15863 SUSE bug 1174386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. Important CVE-2020-15888 SUSE bug 1174367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important CVE-2020-15999 SUSE bug 1177914 SUSE bug 1177936 SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c. Low CVE-2020-16092 SUSE bug 1174641 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196. Important CVE-2020-16119 SUSE bug 1177471 SUSE bug 1177742 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11. Moderate CVE-2020-16120 SUSE bug 1177470 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data. Moderate CVE-2020-16155 SUSE bug 1193811 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c. Moderate CVE-2020-16166 SUSE bug 1174757 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. Critical CVE-2020-16846 SUSE bug 1178361 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Kerberos Security Feature Bypass Vulnerability Important CVE-2020-17049 SUSE bug 1178754 SUSE bug 1178764 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. Important CVE-2020-1711 SUSE bug 1166240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. Important CVE-2020-1712 SUSE bug 1162108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0. Moderate CVE-2020-1726 SUSE bug 1164090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability. Moderate CVE-2020-1730 SUSE bug 1168699 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host. Moderate CVE-2020-17380 SUSE bug 1175144 SUSE bug 1182282 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c. Important CVE-2020-17437 SUSE bug 1179907 SUSE bug 1179908 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures. Important CVE-2020-17438 SUSE bug 1179907 SUSE bug 1179908 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. Important CVE-2020-1749 SUSE bug 1165629 SUSE bug 1165631 SUSE bug 1177511 SUSE bug 1177513 SUSE bug 1189302 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. Moderate CVE-2020-17490 SUSE bug 1178362 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-1751 SUSE bug 1167630 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. Moderate CVE-2020-1752 SUSE bug 1167631 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service. Important CVE-2020-17541 SUSE bug 1186764 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. Moderate CVE-2020-1759 SUSE bug 1166403 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. Moderate CVE-2020-1760 SUSE bug 1166484 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop". Moderate CVE-2020-19131 SUSE bug 1190312 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Moderate CVE-2020-19186 SUSE bug 1214490 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Moderate CVE-2020-19187 SUSE bug 1214491 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Moderate CVE-2020-19188 SUSE bug 1214492 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Moderate CVE-2020-19189 SUSE bug 1214493 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Moderate CVE-2020-19190 SUSE bug 1214494 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f). Important CVE-2020-1967 SUSE bug 1169407 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). Important CVE-2020-1971 SUSE bug 1179491 SUSE bug 1196179 SUSE bug 1199303 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. Important CVE-2020-1983 SUSE bug 1170940 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-14834. Reason: This candidate is a reservation duplicate of CVE-2019-14834. Notes: All CVE users should reference CVE-2019-14834 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Low CVE-2020-20145 SUSE bug 1214514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date. Important CVE-2020-21583 SUSE bug 1214593 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. Moderate CVE-2020-21913 SUSE bug 1193951 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory. Important CVE-2020-22218 SUSE bug 1214527 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Important CVE-2020-24165 SUSE bug 1214732 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. Low CVE-2020-24352 SUSE bug 1175370 SUSE bug 1188609 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). Low CVE-2020-24370 SUSE bug 1175448 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage. Moderate CVE-2020-24371 SUSE bug 1175449 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Important CVE-2020-24489 SUSE bug 1179839 SUSE bug 1192359 SUSE bug 1199300 SUSE bug 1201731 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ. Important CVE-2020-24490 SUSE bug 1177726 SUSE bug 1177727 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial of service via local access. Low CVE-2020-24502 SUSE bug 1182409 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable information disclosure via local access. Low CVE-2020-24503 SUSE bug 1182405 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable denial of service via local access. Moderate CVE-2020-24504 SUSE bug 1182404 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-24511 SUSE bug 1179836 SUSE bug 1192360 SUSE bug 1199300 SUSE bug 1201731 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Low CVE-2020-24512 SUSE bug 1179837 SUSE bug 1192360 SUSE bug 1199300 SUSE bug 1201731 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-24513 SUSE bug 1179833 SUSE bug 1192360 SUSE bug 1199300 SUSE bug 1201731 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data. Moderate CVE-2020-24586 SUSE bug 1185859 SUSE bug 1192868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. Moderate CVE-2020-24587 SUSE bug 1185859 SUSE bug 1185862 SUSE bug 1192868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets. Moderate CVE-2020-24588 SUSE bug 1185861 SUSE bug 1192868 SUSE bug 1199701 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure. Moderate CVE-2020-24659 SUSE bug 1176181 SUSE bug 1178057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script. Moderate CVE-2020-24736 SUSE bug 1210416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. Moderate CVE-2020-24977 SUSE bug 1176179 SUSE bug 1191860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case. Moderate CVE-2020-25085 SUSE bug 1176681 SUSE bug 1182282 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version. Important CVE-2020-25125 SUSE bug 1176034 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2020-2521 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff. Moderate CVE-2020-25211 SUSE bug 1176395 SUSE bug 1192356 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. Important CVE-2020-25212 SUSE bug 1176381 SUSE bug 1176382 SUSE bug 1177027 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion. Important CVE-2020-25219 SUSE bug 1176410 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743. Important CVE-2020-25221 SUSE bug 1176286 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe. Moderate CVE-2020-25284 SUSE bug 1176482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812. Moderate CVE-2020-25285 SUSE bug 1176485 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. Critical CVE-2020-25592 SUSE bug 1178319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, experience shows that it's very common for devices to have out-of-spec "backdoor" operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. All versions of Xen supporting PCI passthrough are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with passed through PCI devices may be able to leverage the vulnerability. Only systems passing through devices with out-of-spec ("backdoor") functionality can cause issues. Experience shows that such out-of-spec functionality is common; unless you have reason to believe that your device does not have such functionality, it's better to assume that it does. Important CVE-2020-25595 SUSE bug 1176344 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than a user-privilege #GP fault (usually converted into SIGSEGV/etc.). Malicious or buggy userspace can crash the guest kernel, resulting in a VM Denial of Service. All versions of Xen from 3.2 onwards are vulnerable. Only x86 systems are vulnerable. ARM platforms are not vulnerable. Only x86 systems that support the SYSENTER instruction in 64bit mode are vulnerable. This is believed to be Intel, Centaur, and Shanghai CPUs. AMD and Hygon CPUs are not believed to be vulnerable. Only x86 PV guests can exploit the vulnerability. x86 PVH / HVM guests cannot exploit the vulnerability. Moderate CVE-2020-25596 SUSE bug 1176345 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. However, operations like the resetting of all event channels may involve decreasing one of the bounds checked when determining validity. This may lead to bug checks triggering, crashing the host. An unprivileged guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only systems with untrusted guests permitted to create more than the default number of event channels are vulnerable. This number depends on the architecture and type of guest. For 32-bit x86 PV guests, this is 1023; for 64-bit x86 PV guests, and for all ARM guests, this number is 4095. Systems where untrusted guests are limited to fewer than this number are not vulnerable. Note that xl and libxl limit max_event_channels to 1023 by default, so systems using exclusively xl, libvirt+libxl, or their own toolstack based on libxl, and not explicitly setting max_event_channels, are not vulnerable. Moderate CVE-2020-25597 SUSE bug 1176346 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability. Moderate CVE-2020-25598 SUSE bug 1176341 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory accesses or triggering of bug checks. In particular, x86 PV guests may be able to elevate their privilege to that of the host. Host and guest crashes are also possible, leading to a Denial of Service (DoS). Information leaks cannot be ruled out. All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable. Important CVE-2020-25599 SUSE bug 1176349 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only 1023 channels, due to limited space in their shared (between guest and Xen) information structure, whereas all other domains can use up to 4095 in this model. The recording of the respective limit during domain initialization, however, has occurred at a time where domains are still deemed to be 64-bit ones, prior to actually honoring respective domain properties. At the point domains get recognized as 32-bit ones, the limit didn't get updated accordingly. Due to this misbehavior in Xen, 32-bit domains (including Domain 0) servicing other domains may observe event channel allocations to succeed when they should really fail. Subsequent use of such event channels would then possibly lead to corruption of other parts of the shared info structure. An unprivileged guest may cause another domain, in particular Domain 0, to misbehave. This may lead to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only x86 32-bit domains servicing other domains are vulnerable. Arm systems, as well as x86 64-bit domains, are not vulnerable. Important CVE-2020-25600 SUSE bug 1176348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these (when resetting all event channels or when cleaning up after the guest) may take extended periods of time. So far, there was no arrangement for preemption at suitable intervals, allowing a CPU to spend an almost unbounded amount of time in the processing of these operations. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. All Xen versions are vulnerable in principle. Whether versions 4.3 and older are vulnerable depends on underlying hardware characteristics. Moderate CVE-2020-25601 SUSE bug 1176350 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access. For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed without error handling for a #GP fault, which is the consequence of trying to read this MSR on non-Intel hardware. A buggy or malicious PV guest administrator can crash Xen, resulting in a host Denial of Service. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only Xen versions 4.11 and onwards are vulnerable. 4.10 and earlier are not vulnerable. Only x86 systems that do not implement the MISC_ENABLE MSR (0x1a0) are vulnerable. AMD and Hygon systems do not implement this MSR and are vulnerable. Intel systems do implement this MSR and are not vulnerable. Other manufacturers have not been checked. Only x86 PV guests can exploit the vulnerability. x86 HVM/PVH guests cannot exploit the vulnerability. Moderate CVE-2020-25602 SUSE bug 1176339 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering. Important CVE-2020-25603 SUSE bug 1176347 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same guest (also operating on the timers) to release a lock that it didn't acquire. The most likely effect of the issue is a hang or crash of the hypervisor, i.e., a Denial of Service (DoS). All versions of Xen are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only x86 HVM guests can leverage the vulnerability. x86 PV and PVH cannot leverage the vulnerability. Only guests with more than one vCPU can exploit the vulnerability. Moderate CVE-2020-25604 SUSE bug 1176343 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver. Moderate CVE-2020-25624 SUSE bug 1176682 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. Low CVE-2020-25625 SUSE bug 1176684 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25632 SUSE bug 1176711 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25637 SUSE bug 1174955 SUSE bug 1177155 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system. Moderate CVE-2020-25639 SUSE bug 1176846 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-25641 SUSE bug 1177121 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25643 SUSE bug 1177206 SUSE bug 1177226 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. Important CVE-2020-25645 SUSE bug 1177511 SUSE bug 1177513 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25647 SUSE bug 1177883 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58. Important CVE-2020-25648 SUSE bug 1177917 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality. Moderate CVE-2020-25656 SUSE bug 1177766 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality. Important CVE-2020-25657 SUSE bug 1178829 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. Moderate CVE-2020-25658 SUSE bug 1178676 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. Moderate CVE-2020-25659 SUSE bug 1178168 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability. Important CVE-2020-25660 SUSE bug 1177843 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op. Moderate CVE-2020-25668 SUSE bug 1178123 SUSE bug 1178622 SUSE bug 1196914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free. Moderate CVE-2020-25669 SUSE bug 1178182 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations. Important CVE-2020-25670 SUSE bug 1178181 SUSE bug 1194680 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations. Important CVE-2020-25671 SUSE bug 1178181 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak vulnerability was found in Linux kernel in llcp_sock_connect Important CVE-2020-25672 SUSE bug 1178181 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system. Important CVE-2020-25673 SUSE bug 1178181 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible. Moderate CVE-2020-25678 SUSE bug 1178905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25681 SUSE bug 1177077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25682 SUSE bug 1177077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Important CVE-2020-25683 SUSE bug 1177077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. Important CVE-2020-25684 SUSE bug 1177077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. Important CVE-2020-25685 SUSE bug 1177077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. Important CVE-2020-25686 SUSE bug 1177077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Important CVE-2020-25687 SUSE bug 1177077 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service. Important CVE-2020-25692 SUSE bug 1178387 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service. Moderate CVE-2020-25704 SUSE bug 1178393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version Important CVE-2020-25705 SUSE bug 1175721 SUSE bug 1178782 SUSE bug 1178783 SUSE bug 1191790 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate is a duplicate of CVE-2020-28916 Moderate CVE-2020-25707 SUSE bug 1178683 SUSE bug 1179468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-25709 SUSE bug 1178909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability. Moderate CVE-2020-25710 SUSE bug 1178909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. Important CVE-2020-25717 SUSE bug 1192284 SUSE bug 1192505 SUSE bug 1192601 SUSE bug 1192849 SUSE bug 1193011 SUSE bug 1194049 SUSE bug 1194307 SUSE bug 1195815 SUSE bug 1196344 SUSE bug 1196717 SUSE bug 1196920 SUSE bug 1205061 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets. Important CVE-2020-25718 SUSE bug 1192246 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise. Important CVE-2020-25719 SUSE bug 1192247 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets. Important CVE-2020-25721 SUSE bug 1192505 SUSE bug 1195833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise. Important CVE-2020-25722 SUSE bug 1192283 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. Low CVE-2020-25723 SUSE bug 1178934 SUSE bug 1178935 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call. Moderate CVE-2020-25743 SUSE bug 1176811 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a. Moderate CVE-2020-26088 SUSE bug 1176990 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. Moderate CVE-2020-26116 SUSE bug 1177120 SUSE bug 1177211 SUSE bug 1192361 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. Moderate CVE-2020-26137 SUSE bug 1177120 SUSE bug 1177211 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients. Moderate CVE-2020-26139 SUSE bug 1186062 SUSE bug 1192868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. Moderate CVE-2020-26141 SUSE bug 1185987 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. Moderate CVE-2020-26145 SUSE bug 1185860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Moderate CVE-2020-26147 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header. Important CVE-2020-26154 SUSE bug 1177143 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2020-26159 SUSE bug 1177179 SUSE bug 1203568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c. Moderate CVE-2020-26541 SUSE bug 1177282 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time. Moderate CVE-2020-26558 SUSE bug 1179610 SUSE bug 1186463 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file. Moderate CVE-2020-26570 SUSE bug 1177364 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init. Moderate CVE-2020-26571 SUSE bug 1177380 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher. Moderate CVE-2020-26572 SUSE bug 1177378 SUSE bug 1179291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel Moderate CVE-2020-27068 SUSE bug 1180086 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit. Moderate CVE-2020-27170 SUSE bug 1183686 SUSE bug 1183775 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d. Moderate CVE-2020-27171 SUSE bug 1183686 SUSE bug 1183775 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a. Moderate CVE-2020-27194 SUSE bug 1177889 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest. Low CVE-2020-2732 SUSE bug 1163971 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() function. Moderate CVE-2020-27418 SUSE bug 1214919 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228. Low CVE-2020-27618 SUSE bug 1178386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. Important CVE-2020-27619 SUSE bug 1178009 SUSE bug 1180254 SUSE bug 1193386 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated. Important CVE-2020-27670 SUSE bug 1177414 SUSE bug 1178658 SUSE bug 1183925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled. Important CVE-2020-27671 SUSE bug 1177413 SUSE bug 1183925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages. Important CVE-2020-27672 SUSE bug 1177412 SUSE bug 1178658 SUSE bug 1183925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271. Moderate CVE-2020-27673 SUSE bug 1177411 SUSE bug 1184583 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique. Moderate CVE-2020-27674 SUSE bug 1177409 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. Moderate CVE-2020-27675 SUSE bug 1177410 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-27749 SUSE bug 1179264 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel. Moderate CVE-2020-27777 SUSE bug 1179107 SUSE bug 1179419 SUSE bug 1200343 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-27779 SUSE bug 1179265 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0. Important CVE-2020-27781 SUSE bug 1179802 SUSE bug 1180155 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free(). Low CVE-2020-27784 SUSE bug 1202895 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2020-27786 SUSE bug 1179601 SUSE bug 1179616 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2020-27815 SUSE bug 1179454 SUSE bug 1179458 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver). Low CVE-2020-27820 SUSE bug 1179599 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0. Moderate CVE-2020-27821 SUSE bug 1179686 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat. Important CVE-2020-27825 SUSE bug 1179960 SUSE bug 1179961 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash. Moderate CVE-2020-27830 SUSE bug 1179656 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system. Moderate CVE-2020-27835 SUSE bug 1179878 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity. Low CVE-2020-27839 SUSE bug 1179997 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability. Important CVE-2020-27840 SUSE bug 1183572 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. Moderate CVE-2020-28097 SUSE bug 1187723 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit. Important CVE-2020-28196 SUSE bug 1178512 SUSE bug 1183911 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory. Important CVE-2020-28243 SUSE bug 1181550 SUSE bug 1181556 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen. Moderate CVE-2020-28368 SUSE bug 1178591 SUSE bug 1178658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Important CVE-2020-28374 SUSE bug 1178372 SUSE bug 1178684 SUSE bug 1180676 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2020-28407 SUSE bug 1198395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. Important CVE-2020-28493 SUSE bug 1181944 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents. Low CVE-2020-28588 SUSE bug 1182806 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def. Moderate CVE-2020-28915 SUSE bug 1178886 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once. Moderate CVE-2020-28941 SUSE bug 1178740 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate. Important CVE-2020-28972 SUSE bug 1181550 SUSE bug 1181557 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height. Moderate CVE-2020-28974 SUSE bug 1178589 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly gain privileges because of an off-by-one error. NOTE: this issue is caused by an incorrect fix for CVE-2020-27671. Important CVE-2020-29040 SUSE bug 1178963 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. Low CVE-2020-29129 SUSE bug 1179466 SUSE bug 1179467 SUSE bug 1179477 SUSE bug 1179484 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. Moderate CVE-2020-29130 SUSE bug 1178658 SUSE bug 1179467 SUSE bug 1179477 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc. Important CVE-2020-29361 SUSE bug 1180064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation. Moderate CVE-2020-29362 SUSE bug 1180065 SUSE bug 1201534 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1. Moderate CVE-2020-29368 SUSE bug 1179428 SUSE bug 1179660 SUSE bug 1179664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe. Moderate CVE-2020-29369 SUSE bug 1173504 SUSE bug 1179432 SUSE bug 1179646 SUSE bug 1182109 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71. Moderate CVE-2020-29370 SUSE bug 1179435 SUSE bug 1179648 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd. Low CVE-2020-29371 SUSE bug 1179429 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e. Low CVE-2020-29372 SUSE bug 1179433 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d. Important CVE-2020-29373 SUSE bug 1179434 SUSE bug 1179779 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way. Moderate CVE-2020-29385 SUSE bug 1180393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest administrator can also use the special watches, which will cause a notification every time a domain is created and destroyed. Data may include: number, type, and domids of other VMs; existence and domids of driver domains; numbers of virtual interfaces, block devices, vcpus; existence of virtual framebuffers and their backend style (e.g., existence of VNC service); Xen VM UUIDs for other domains; timing information about domain creation and device setup; and some hints at the backend provisioning of VMs and their devices. The watch events do not contain values stored in xenstore, only key names. A guest administrator can observe non-sensitive domain and device lifecycle events relating to other guests. This information allows some insight into overall system configuration (including the number and general nature of other guests), and configuration of other guests (including the number and general nature of other guests' devices). This information might be commercially interesting or might make other attacks easier. There is not believed to be exposure of sensitive data. Specifically, there is no exposure of VNC passwords, port numbers, pathnames in host and guest filesystems, cryptographic keys, or within-guest data. Low CVE-2020-29480 SUSE bug 1178658 SUSE bug 1179496 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed when a domain is being destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes from the previous domain(s) with the same domid. Because all Xenstore entries of a guest below /local/domain/<domid> are being deleted by Xen tools when a guest is destroyed, only Xenstore entries of other guests still running are affected. For example, a newly created guest domain might be able to read sensitive information that had belonged to a previously existing guest domain. Both Xenstore implementations (C and Ocaml) are vulnerable. Moderate CVE-2020-29481 SUSE bug 1176349 SUSE bug 1178658 SUSE bug 1179498 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately, this is done by just removing the guest from xenstored's internal management, resulting in the same actions as if the guest had been destroyed, including sending an @releaseDomain event. @releaseDomain events do not say that the guest has been removed. All watchers of this event must look at the states of all guests to find the guest that has been removed. When an @releaseDomain is generated due to a domain xenstored protocol violation, because the guest is still running, the watchers will not react. Later, when the guest is actually destroyed, xenstored will no longer have it stored in its internal data base, so no further @releaseDomain event will be sent. This can lead to a zombie domain; memory mappings of that guest's memory will not be removed, due to the missing event. This zombie domain will be cleaned up only after another domain is destroyed, as that will trigger another @releaseDomain event. If the device model of the guest that violated the Xenstore protocol is running in a stub-domain, a use-after-free case could happen in xenstored, after having removed the guest from its internal data base, possibly resulting in a crash of xenstored. A malicious guest can block resources of the host for a period after its own death. Guests with a stub domain device model can eventually crash xenstored, resulting in a more serious denial of service (the prevention of any further domain management operations). Only the C variant of Xenstore is affected; the Ocaml variant is not affected. Only HVM guests with a stubdom device model can cause a serious DoS. Moderate CVE-2020-29483 SUSE bug 1178658 SUSE bug 1179502 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch, and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages, consisting of a message header and the payload. The payload length is limited to 4096 bytes. Any request to xenstored resulting in a response with a payload longer than 4096 bytes will result in an error. When registering a watch, the payload length limit applies to the combined length of the watched path and the specified tag. Because watches for a specific path are also triggered for all nodes below that path, the payload of a watch event message can be longer than the payload needed to register the watch. A malicious guest that registers a watch using a very large tag (i.e., with a registration operation payload length close to the 4096 byte limit) can cause the generation of watch events with a payload length larger than 4096 bytes, by writing to Xenstore entries below the watched path. This will result in an error condition in xenstored. This error can result in a NULL pointer dereference, leading to a crash of xenstored. A malicious guest administrator can cause xenstored to crash, leading to a denial of service. Following a xenstored crash, domains may continue to run, but management operations will be impossible. Only C xenstored is affected, oxenstored is not affected. Moderate CVE-2020-29484 SUSE bug 1178658 SUSE bug 1179501 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94. Moderate CVE-2020-29534 SUSE bug 1179598 SUSE bug 1180564 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. Moderate CVE-2020-29562 SUSE bug 1179694 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation, via an event channel, so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation, the de-schedule / re-schedule cycle would repeat. If, in addition, Xen is resignalled very quickly, the re-schedule may occur before the de-schedule was fully complete, triggering a shortcut. This potentially repeating process uses ordinary recursive function calls, and thus could result in a stack overflow. A malicious or buggy stubdomain serving a HVM guest can cause Xen to crash, resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are affected. Arm systems are not affected. Only x86 stubdomains serving HVM guests can exploit the vulnerability. Moderate CVE-2020-29566 SUSE bug 1178658 SUSE bug 1179506 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-allocated on the relevant CPUs. De-allocation has to happen when certain constraints are met. If these conditions are not met when first checked, the checking CPU may send an interrupt to itself, in the expectation that this IRQ will be delivered only after the condition preventing the cleanup has cleared. For two specific IRQ vectors, this expectation was violated, resulting in a continuous stream of self-interrupts, which renders the CPU effectively unusable. A domain with a passed through PCI device can cause lockup of a physical CPU, resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with physical PCI devices passed through to them can exploit the vulnerability. Moderate CVE-2020-29567 SUSE bug 1179513 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable. Moderate CVE-2020-29568 SUSE bug 1179508 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback. Important CVE-2020-29569 SUSE bug 1179509 SUSE bug 1180008 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. Moderate CVE-2020-29570 SUSE bug 1179514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes, the consumer side isn't protected against re-ordered reads, and may hence end up de-referencing a NULL pointer. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. Only Arm systems may be vulnerable. Whether a system is vulnerable depends on the specific CPU. x86 systems are not vulnerable. Moderate CVE-2020-29571 SUSE bug 1179516 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference. Important CVE-2020-29573 SUSE bug 1179721 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality. Moderate CVE-2020-29651 SUSE bug 1179805 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24. Important CVE-2020-29660 SUSE bug 1179745 SUSE bug 1179877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b. Important CVE-2020-29661 SUSE bug 1179745 SUSE bug 1179877 SUSE bug 1214268 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection, when using BT_SNDMTU/BT_RCVMTU for SCO sockets. This could allow a local attacker with a special user privilege to crash the system (DOS) or leak kernel internal information. Moderate CVE-2020-35499 SUSE bug 1180460 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem Moderate CVE-2020-35501 SUSE bug 1182435 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-35503 SUSE bug 1180432 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-35504 SUSE bug 1180433 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-35505 SUSE bug 1180434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process. Moderate CVE-2020-35506 SUSE bug 1180435 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process. Moderate CVE-2020-35508 SUSE bug 1180529 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors Moderate CVE-2020-35512 SUSE bug 1187105 SUSE bug 1189662 SUSE bug 1205052 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service. Moderate CVE-2020-35513 SUSE bug 1181362 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2020-35519 SUSE bug 1183696 SUSE bug 1184953 SUSE bug 1211495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service. Moderate CVE-2020-35521 SUSE bug 1182808 SUSE bug 1200195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack. Moderate CVE-2020-35522 SUSE bug 1182809 SUSE bug 1200195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Moderate CVE-2020-35523 SUSE bug 1182811 SUSE bug 1200195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Moderate CVE-2020-35524 SUSE bug 1182812 SUSE bug 1200195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo. Moderate CVE-2020-35538 SUSE bug 1202915 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. Important CVE-2020-35662 SUSE bug 1181550 SUSE bug 1181565 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code). Low CVE-2020-35905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332. Important CVE-2020-36158 SUSE bug 1180559 SUSE bug 1180562 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck). Moderate CVE-2020-36221 SUSE bug 1182420 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. Moderate CVE-2020-36222 SUSE bug 1182419 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read). Moderate CVE-2020-36223 SUSE bug 1182418 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Moderate CVE-2020-36224 SUSE bug 1182417 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Important CVE-2020-36225 SUSE bug 1182416 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. Moderate CVE-2020-36226 SUSE bug 1182415 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. Important CVE-2020-36227 SUSE bug 1182413 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service. Important CVE-2020-36228 SUSE bug 1182412 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. Important CVE-2020-36229 SUSE bug 1182408 SUSE bug 1182411 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. Moderate CVE-2020-36230 SUSE bug 1182408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. Important CVE-2020-36242 SUSE bug 1182066 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52. Moderate CVE-2020-36310 SUSE bug 1184512 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184. Low CVE-2020-36311 SUSE bug 1184511 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d. Low CVE-2020-36312 SUSE bug 1184509 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after a deletion, aka CID-0774a964ef56. This affects arch/s390/kvm/kvm-s390.c, include/linux/kvm_host.h, and virt/kvm/kvm_main.c. Important CVE-2020-36313 SUSE bug 1184504 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950. Important CVE-2020-36322 SUSE bug 1184211 SUSE bug 1184952 SUSE bug 1189302 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c. Important CVE-2020-36385 SUSE bug 1187050 SUSE bug 1187052 SUSE bug 1189302 SUSE bug 1196174 SUSE bug 1196810 SUSE bug 1196914 SUSE bug 1200084 SUSE bug 1201734 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. Moderate CVE-2020-36386 SUSE bug 1187038 SUSE bug 1192868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35. Important CVE-2020-36387 SUSE bug 1187053 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes. Low CVE-2020-36465 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. Important CVE-2020-36516 SUSE bug 1196616 SUSE bug 1196867 SUSE bug 1204092 SUSE bug 1204183 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. Important CVE-2020-36557 SUSE bug 1201429 SUSE bug 1201742 SUSE bug 1202874 SUSE bug 1205313 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. Important CVE-2020-36558 SUSE bug 1200910 SUSE bug 1201752 SUSE bug 1205313 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference. Moderate CVE-2020-36691 SUSE bug 1209613 SUSE bug 1209777 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace. NOTE: cc00bca was reverted in 5.12. Moderate CVE-2020-36694 SUSE bug 1211596 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct. Low CVE-2020-36766 SUSE bug 1215299 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 Important CVE-2020-3702 SUSE bug 1191193 SUSE bug 1191529 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges. Important CVE-2020-3898 SUSE bug 1168422 SUSE bug 1170671 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296. Moderate CVE-2020-4788 SUSE bug 1177666 SUSE bug 1181158 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected. Low CVE-2020-6750 SUSE bug 1160668 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80. Critical CVE-2020-6829 SUSE bug 1174763 SUSE bug 1175686 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Moderate CVE-2020-7039 SUSE bug 1161066 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka CID-7dc40713618c. This is related to i915_gem_context_destroy_ioctl in drivers/gpu/drm/i915/i915_gem_context.c. Moderate CVE-2020-7053 SUSE bug 1160966 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option. Moderate CVE-2020-7216 SUSE bug 1160905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id. Moderate CVE-2020-7217 SUSE bug 1160906 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. Moderate CVE-2020-7595 SUSE bug 1161517 SUSE bug 1191860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate. Important CVE-2020-7919 SUSE bug 1164288 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1. Moderate CVE-2020-8013 SUSE bug 1163922 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1. Important CVE-2020-8023 SUSE bug 1172698 SUSE bug 1190347 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624. Moderate CVE-2020-8025 SUSE bug 1171883 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.37.1. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.18.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.9.1. Important CVE-2020-8027 SUSE bug 1175568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions. Important CVE-2020-8032 SUSE bug 1180669 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). Moderate CVE-2020-8169 SUSE bug 1173026 SUSE bug 1186108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. Important CVE-2020-8177 SUSE bug 1173027 SUSE bug 1186108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. Low CVE-2020-8231 SUSE bug 1175109 SUSE bug 1179399 SUSE bug 1186108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1. Important CVE-2020-8277 SUSE bug 1178882 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. Moderate CVE-2020-8284 SUSE bug 1179398 SUSE bug 1179399 SUSE bug 1186108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Moderate CVE-2020-8285 SUSE bug 1179399 SUSE bug 1186108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Moderate CVE-2020-8286 SUSE bug 1179593 SUSE bug 1186108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if the socket is being moved to a new parent directory and its old parent directory is being removed. Moderate CVE-2020-8428 SUSE bug 1162109 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. Moderate CVE-2020-8492 SUSE bug 1162367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. Moderate CVE-2020-8608 SUSE bug 1163018 SUSE bug 1163019 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. Moderate CVE-2020-8647 SUSE bug 1162929 SUSE bug 1164078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. Moderate CVE-2020-8648 SUSE bug 1162928 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. Moderate CVE-2020-8649 SUSE bug 1162929 SUSE bug 1162931 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-8694 SUSE bug 1170415 SUSE bug 1170446 SUSE bug 1178591 SUSE bug 1178700 SUSE bug 1179661 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2020-8695 SUSE bug 1170415 SUSE bug 1170446 SUSE bug 1178591 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Low CVE-2020-8696 SUSE bug 1173592 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Low CVE-2020-8698 SUSE bug 1173594 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file") Important CVE-2020-8834 SUSE bug 1168276 SUSE bug 1173945 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780) Moderate CVE-2020-8835 SUSE bug 1167722 SUSE bug 1173755 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. Moderate CVE-2020-8927 SUSE bug 1175825 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size. Low CVE-2020-8992 SUSE bug 1164069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. Moderate CVE-2020-9327 SUSE bug 1164719 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2. Moderate CVE-2020-9383 SUSE bug 1165111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Moderate CVE-2021-0089 SUSE bug 1186433 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potentially enable a denial of service via local access. Moderate CVE-2021-0127 SUSE bug 1195779 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access. Moderate CVE-2021-0129 SUSE bug 1186463 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2021-0145 SUSE bug 1195780 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentially enable escalation of privilege via physical access. Important CVE-2021-0146 SUSE bug 1192615 SUSE bug 1193500 SUSE bug 1200661 SUSE bug 1200663 SUSE bug 1205062 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 Important CVE-2021-0326 SUSE bug 1181777 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. User interaction is not required for exploitation. Product: Android; Versions: Android kernel; Android ID: A-146554327. Moderate CVE-2021-0342 SUSE bug 1180812 SUSE bug 1180859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173843328References: Upstream kernel Important CVE-2021-0512 SUSE bug 1187595 SUSE bug 1187597 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476 Important CVE-2021-0605 SUSE bug 1187601 SUSE bug 1187687 SUSE bug 1188381 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In drm_syncobj_handle_to_fd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168034487 Moderate CVE-2021-0606 SUSE bug 1187602 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In dma_buf_release of dma-buf.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-155756045References: Upstream kernel Important CVE-2021-0707 SUSE bug 1198437 SUSE bug 1199332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194461020References: Upstream kernel Important CVE-2021-0924 SUSE bug 1193792 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187527909References: Upstream kernel Important CVE-2021-0929 SUSE bug 1193794 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171418586References: Upstream kernel Moderate CVE-2021-0938 SUSE bug 1192039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In set_default_passthru_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186026549References: N/A Low CVE-2021-0939 SUSE bug 1192043 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel Important CVE-2021-0941 SUSE bug 1192045 SUSE bug 1192048 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196046570References: Upstream kernel Moderate CVE-2021-0961 SUSE bug 1193790 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194697257References: N/A Low CVE-2021-1043 SUSE bug 1199357 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected. Moderate CVE-2021-20177 SUSE bug 1180765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability. Important CVE-2021-20181 SUSE bug 1182137 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability. Low CVE-2021-20193 SUSE bug 1181131 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Low CVE-2021-20196 SUSE bug 1181361 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. Low CVE-2021-20199 SUSE bug 1181640 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection. Moderate CVE-2021-20201 SUSE bug 1181686 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario. Low CVE-2021-20203 SUSE bug 1181639 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-20206 SUSE bug 1181961 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity. Moderate CVE-2021-20208 SUSE bug 1183239 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege could delay the loop (due to a changing ldata->read_head, and a missing sanity check) and cause a threat to the system availability. Moderate CVE-2021-20219 SUSE bug 1184397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario. Moderate CVE-2021-20221 SUSE bug 1181933 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-20225 SUSE bug 1182262 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability. Important CVE-2021-20226 SUSE bug 1180564 SUSE bug 1181846 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences. Important CVE-2021-20231 SUSE bug 1183457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences. Important CVE-2021-20232 SUSE bug 1183456 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-20233 SUSE bug 1182263 SUSE bug 1183135 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met. Important CVE-2021-20251 SUSE bug 1206546 SUSE bug 1208433 SUSE bug 1209325 SUSE bug 1209664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity. Important CVE-2021-20254 SUSE bug 1184677 SUSE bug 1185886 SUSE bug 1189860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Low CVE-2021-20255 SUSE bug 1182651 SUSE bug 1182654 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Low CVE-2021-20257 SUSE bug 1182577 SUSE bug 1182846 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest. Low CVE-2021-20263 SUSE bug 1183373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-20265 SUSE bug 1183089 SUSE bug 1214268 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability. Low CVE-2021-20266 SUSE bug 1183632 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-20268 SUSE bug 1183077 SUSE bug 1183095 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47. Moderate CVE-2021-20269 SUSE bug 1189468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability. Low CVE-2021-20271 SUSE bug 1183545 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability. Important CVE-2021-20277 SUSE bug 1183574 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-20288 SUSE bug 1183074 SUSE bug 1205049 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). Moderate CVE-2021-20291 SUSE bug 1196497 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker with a local account with a root privilege, can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Moderate CVE-2021-20292 SUSE bug 1183723 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-20305 SUSE bug 1183835 SUSE bug 1184401 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share. Moderate CVE-2021-20316 SUSE bug 1191227 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system. Moderate CVE-2021-20321 SUSE bug 1191647 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Important CVE-2021-20322 SUSE bug 1191790 SUSE bug 1191813 SUSE bug 1193290 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user. Low CVE-2021-21284 SUSE bug 1181732 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing. Moderate CVE-2021-21285 SUSE bug 1181730 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions. Moderate CVE-2021-21334 SUSE bug 1183397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11 Low CVE-2021-21781 SUSE bug 1188445 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion. Moderate CVE-2021-21996 SUSE bug 1190265 SUSE bug 1210934 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation. Important CVE-2021-22543 SUSE bug 1186482 SUSE bug 1186483 SUSE bug 1190276 SUSE bug 1197660 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space Important CVE-2021-22555 SUSE bug 1188116 SUSE bug 1188117 SUSE bug 1188411 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions. Moderate CVE-2021-22569 SUSE bug 1194530 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater. Moderate CVE-2021-22570 SUSE bug 1195258 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 Important CVE-2021-22600 SUSE bug 1195184 SUSE bug 1195307 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request. Moderate CVE-2021-22876 SUSE bug 1183933 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check. Low CVE-2021-22890 SUSE bug 1183934 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol. Moderate CVE-2021-22898 SUSE bug 1186114 SUSE bug 1192450 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk. Moderate CVE-2021-22922 SUSE bug 1188217 SUSE bug 1192447 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened. Moderate CVE-2021-22923 SUSE bug 1188218 SUSE bug 1192447 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate. Moderate CVE-2021-22924 SUSE bug 1188219 SUSE bug 1192447 SUSE bug 1200196 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application. Moderate CVE-2021-22925 SUSE bug 1188220 SUSE bug 1192447 SUSE bug 1200196 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network. Moderate CVE-2021-22946 SUSE bug 1190373 SUSE bug 1194948 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server. Moderate CVE-2021-22947 SUSE bug 1190374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability. Important CVE-2021-23134 SUSE bug 1186060 SUSE bug 1186061 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements. Moderate CVE-2021-23192 SUSE bug 1192214 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path. Low CVE-2021-23239 SUSE bug 1171722 SUSE bug 1180684 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable. Important CVE-2021-23240 SUSE bug 1171722 SUSE bug 1180685 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. Moderate CVE-2021-23336 SUSE bug 1182179 SUSE bug 1182379 SUSE bug 1182433 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). Moderate CVE-2021-23840 SUSE bug 1182333 SUSE bug 1187743 SUSE bug 1214334 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). Moderate CVE-2021-23841 SUSE bug 1182331 SUSE bug 1187743 SUSE bug 1214334 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties. Moderate CVE-2021-24031 SUSE bug 1183371 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties. Moderate CVE-2021-24032 SUSE bug 1183370 SUSE bug 1183371 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master. Important CVE-2021-25281 SUSE bug 1181550 SUSE bug 1181559 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. Important CVE-2021-25282 SUSE bug 1181550 SUSE bug 1181560 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. Important CVE-2021-25283 SUSE bug 1181550 SUSE bug 1181561 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. Important CVE-2021-25284 SUSE bug 1181550 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. Critical CVE-2021-25315 SUSE bug 1182382 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterprise Server 15-SP2 s390-tools versions prior to 2.11.0-9.20.1. Low CVE-2021-25316 SUSE bug 1180877 SUSE bug 1182777 SUSE bug 1182876 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions. Low CVE-2021-25317 SUSE bug 1184161 SUSE bug 1192358 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many. Important CVE-2021-25900 SUSE bug 1183403 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity. Moderate CVE-2021-26312 SUSE bug 1192617 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information. Moderate CVE-2021-26318 SUSE bug 1191653 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers. Moderate CVE-2021-26339 SUSE bug 1199459 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. Moderate CVE-2021-26341 SUSE bug 1196901 SUSE bug 1201050 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a new virtual machine control block (VMCB). The failure to flush the TLB may cause the microcode to use stale TLB translations which may allow for disclosure of SEV guest memory contents. Users of SEV-ES/SEV-SNP guest VMs are not impacted by this vulnerability. Moderate CVE-2021-26342 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service. Moderate CVE-2021-26347 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity. Moderate CVE-2021-26348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA). Moderate CVE-2021-26349 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial of service. Moderate CVE-2021-26350 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an exception handling leading to a potential denial of service. Moderate CVE-2021-26364 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service. Moderate CVE-2021-26372 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service. Moderate CVE-2021-26373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service. Moderate CVE-2021-26375 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service. Moderate CVE-2021-26376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service. Moderate CVE-2021-26378 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service. Moderate CVE-2021-26388 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support. Moderate CVE-2021-26708 SUSE bug 1181806 SUSE bug 1183298 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product. Important CVE-2021-26720 SUSE bug 1180827 SUSE bug 1180865 SUSE bug 1181852 SUSE bug 1186412 SUSE bug 1205048 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c. Important CVE-2021-26930 SUSE bug 1181843 SUSE bug 1182294 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c. Moderate CVE-2021-26931 SUSE bug 1181753 SUSE bug 1183022 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c. Moderate CVE-2021-26932 SUSE bug 1181747 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime. Important CVE-2021-27212 SUSE bug 1182279 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation. Moderate CVE-2021-27218 SUSE bug 1182328 SUSE bug 1182362 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption. Moderate CVE-2021-27219 SUSE bug 1182362 SUSE bug 1194015 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables. Important CVE-2021-27363 SUSE bug 1182716 SUSE bug 1182717 SUSE bug 1183120 SUSE bug 1200084 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages. Important CVE-2021-27364 SUSE bug 1182715 SUSE bug 1182716 SUSE bug 1182717 SUSE bug 1200084 SUSE bug 1214268 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message. Moderate CVE-2021-27365 SUSE bug 1182712 SUSE bug 1182715 SUSE bug 1183491 SUSE bug 1200084 SUSE bug 1214268 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data. Critical CVE-2021-27378 SUSE bug 1182432 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c. Low CVE-2021-27645 SUSE bug 1182733 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. Important CVE-2021-27803 SUSE bug 1182805 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers. Moderate CVE-2021-27853 SUSE bug 1203840 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse. Moderate CVE-2021-27854 SUSE bug 1203839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers) Moderate CVE-2021-27861 SUSE bug 1203838 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers). Moderate CVE-2021-27862 SUSE bug 1182623 SUSE bug 1203837 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931. Moderate CVE-2021-28038 SUSE bug 1183022 SUSE bug 1183069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG. Moderate CVE-2021-28039 SUSE bug 1183035 SUSE bug 1183071 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. Important CVE-2021-28041 SUSE bug 1183137 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.) Low CVE-2021-28153 SUSE bug 1183533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An unlimited recursion in DxeCore in EDK II. Moderate CVE-2021-28210 SUSE bug 1183579 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. Moderate CVE-2021-28211 SUSE bug 1183578 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308. Important CVE-2021-28375 SUSE bug 1183596 SUSE bug 1184955 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base. Important CVE-2021-28660 SUSE bug 1183593 SUSE bug 1183658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS. Moderate CVE-2021-28687 SUSE bug 1183072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11. Moderate CVE-2021-28688 SUSE bug 1183646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated. Moderate CVE-2021-28689 SUSE bug 1185104 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend. Moderate CVE-2021-28690 SUSE bug 1186434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer. Important CVE-2021-28691 SUSE bug 1186430 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded. Moderate CVE-2021-28692 SUSE bug 1186429 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm. Moderate CVE-2021-28693 SUSE bug 1186428 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696). Important CVE-2021-28694 SUSE bug 1189373 SUSE bug 1189980 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696). Important CVE-2021-28695 SUSE bug 1189373 SUSE bug 1189980 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696). Important CVE-2021-28696 SUSE bug 1189373 SUSE bug 1189980 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes. Important CVE-2021-28697 SUSE bug 1189376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would iterate over all such entries, including ones which aren't in use anymore and some which may have been created but never used. If the number of entries for a given domain is large enough, this iterating of the entire table may tie up a CPU for too long, starving other domains or causing issues in the hypervisor itself. Note that a domain may map its own grants, i.e. there is no need for multiple domains to be involved here. A pair of "cooperating" guests may, however, cause the effects to be more severe. Moderate CVE-2021-28698 SUSE bug 1189378 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has to occur because the interface structure layouts commonly differ between 32- and 64-bit. The translation of the request to obtain the frame numbers of the grant status table involves translating the resulting array of frame numbers. Since the space used to carry out the translation is limited, the translation layer tells the core function the capacity of the array within translation space. Unfortunately the core function then only enforces array bounds to be below 8 times the specified value, and would write past the available space if enough frame numbers needed storing. Moderate CVE-2021-28699 SUSE bug 1189380 SUSE bug 1194306 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured. Moderate CVE-2021-28700 SUSE bug 1189381 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed. Important CVE-2021-28701 SUSE bug 1189632 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption. Moderate CVE-2021-28702 SUSE bug 1191363 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes. This bug was fortuitously fixed by code cleanup in Xen 4.14, and backported to security-supported Xen branches as a prerequisite of the fix for XSA-378. Moderate CVE-2021-28703 SUSE bug 1192555 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2). Moderate CVE-2021-28704 SUSE bug 1192557 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.) Moderate CVE-2021-28705 SUSE bug 1192559 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound. Moderate CVE-2021-28706 SUSE bug 1192554 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2). Moderate CVE-2021-28707 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2). Moderate CVE-2021-28708 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.) Moderate CVE-2021-28709 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713 Moderate CVE-2021-28711 SUSE bug 1193440 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713 Moderate CVE-2021-28712 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713 Moderate CVE-2021-28713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714) Moderate CVE-2021-28714 SUSE bug 1193442 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714) Moderate CVE-2021-28715 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." Important CVE-2021-28861 SUSE bug 1202624 SUSE bug 1204077 SUSE bug 1204801 SUSE bug 1204802 SUSE bug 1205068 SUSE bug 1205075 SUSE bug 1205467 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1. Moderate CVE-2021-28950 SUSE bug 1184194 SUSE bug 1184211 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25. Moderate CVE-2021-28951 SUSE bug 1184195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.) Important CVE-2021-28952 SUSE bug 1184197 SUSE bug 1184199 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc. Moderate CVE-2021-28964 SUSE bug 1184193 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. Moderate CVE-2021-28971 SUSE bug 1184196 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. Moderate CVE-2021-28972 SUSE bug 1184198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. Moderate CVE-2021-29154 SUSE bug 1184391 SUSE bug 1184710 SUSE bug 1186408 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations. Moderate CVE-2021-29155 SUSE bug 1184942 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled, aka CID-d8861bab48b6. Moderate CVE-2021-29264 SUSE bug 1184168 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70. Moderate CVE-2021-29265 SUSE bug 1184167 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0. Moderate CVE-2021-29266 SUSE bug 1184166 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8. Moderate CVE-2021-29646 SUSE bug 1184191 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624. Moderate CVE-2021-29647 SUSE bug 1184192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245. Moderate CVE-2021-29648 SUSE bug 1184200 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677. Moderate CVE-2021-29649 SUSE bug 1184205 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf. Moderate CVE-2021-29650 SUSE bug 1184208 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun. Important CVE-2021-29657 SUSE bug 1188637 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. Important CVE-2021-29921 SUSE bug 1185706 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b. Moderate CVE-2021-30002 SUSE bug 1184120 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. Moderate CVE-2021-30004 SUSE bug 1184348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987. Moderate CVE-2021-30178 SUSE bug 1184499 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition. Important CVE-2021-30465 SUSE bug 1185405 SUSE bug 1189161 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important CVE-2021-30560 SUSE bug 1188373 SUSE bug 1208574 SUSE bug 1211500 SUSE bug 1211501 SUSE bug 1211544 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) Important CVE-2021-3144 SUSE bug 1181550 SUSE bug 1181562 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. Important CVE-2021-3148 SUSE bug 1181550 SUSE bug 1181558 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations. Moderate CVE-2021-31525 SUSE bug 1185790 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session. Important CVE-2021-31535 SUSE bug 1182506 SUSE bug 1191879 SUSE bug 1205051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. Important CVE-2021-3156 SUSE bug 1180684 SUSE bug 1181090 SUSE bug 1181506 SUSE bug 1181657 SUSE bug 1183936 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely). Moderate CVE-2021-31607 SUSE bug 1185281 SUSE bug 1210934 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. Moderate CVE-2021-3177 SUSE bug 1181126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, allows attackers to overwrite heap memory via PhysmemNewRamBackedPMR. Moderate CVE-2021-31795 SUSE bug 1185354 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-31916 SUSE bug 1192781 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request. Important CVE-2021-3197 SUSE bug 1181550 SUSE bug 1181564 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4. Low CVE-2021-32078 SUSE bug 1187489 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit. Critical CVE-2021-32292 SUSE bug 1214699 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method. Low CVE-2021-3236 SUSE bug 1214235 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller. Important CVE-2021-32399 SUSE bug 1184611 SUSE bug 1185898 SUSE bug 1185899 SUSE bug 1196174 SUSE bug 1200084 SUSE bug 1201734 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.) Important CVE-2021-32606 SUSE bug 1185953 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks." The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain a `Transfer-Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers. Moderate CVE-2021-32714 SUSE bug 1188174 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix. Low CVE-2021-32715 SUSE bug 1188173 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files. Low CVE-2021-32760 SUSE bug 1188282 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value. Moderate CVE-2021-33033 SUSE bug 1186109 SUSE bug 1186283 SUSE bug 1188876 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. Important CVE-2021-33034 SUSE bug 1186111 SUSE bug 1186285 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access. Moderate CVE-2021-33061 SUSE bug 1196426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of service via local access. Moderate CVE-2021-33098 SUSE bug 1192877 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access. Low CVE-2021-33120 SUSE bug 1195781 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. Moderate CVE-2021-33135 SUSE bug 1199515 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit. Important CVE-2021-33200 SUSE bug 1186484 SUSE bug 1186498 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input Low CVE-2021-33226 SUSE bug 1208473 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. Moderate CVE-2021-3326 SUSE bug 1181505 SUSE bug 1212283 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458. Important CVE-2021-3347 SUSE bug 1181349 SUSE bug 1181553 SUSE bug 1190859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71. Moderate CVE-2021-3348 SUSE bug 1181504 SUSE bug 1181645 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. Important CVE-2021-33503 SUSE bug 1187045 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP. Important CVE-2021-33560 SUSE bug 1187212 SUSE bug 1189854 SUSE bug 1199664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact. Moderate CVE-2021-33574 SUSE bug 1186489 SUSE bug 1189426 SUSE bug 1192788 SUSE bug 1196766 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db. Moderate CVE-2021-33624 SUSE bug 1187554 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. Important CVE-2021-33655 SUSE bug 1201635 SUSE bug 1202087 SUSE bug 1205313 SUSE bug 1212291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. Moderate CVE-2021-33656 SUSE bug 1201636 SUSE bug 1212286 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05. Important CVE-2021-33909 SUSE bug 1188062 SUSE bug 1188063 SUSE bug 1188257 SUSE bug 1189302 SUSE bug 1190859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash. Moderate CVE-2021-33910 SUSE bug 1188062 SUSE bug 1188063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected. Low CVE-2021-3392 SUSE bug 1189236 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Low CVE-2021-33928 SUSE bug 1190148 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Low CVE-2021-33929 SUSE bug 1190149 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Low CVE-2021-33930 SUSE bug 1190150 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Low CVE-2021-33938 SUSE bug 1190147 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this. Moderate CVE-2021-3409 SUSE bug 1182282 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Moderate CVE-2021-3411 SUSE bug 1182498 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario. Low CVE-2021-3416 SUSE bug 1182968 SUSE bug 1186473 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. Moderate CVE-2021-3419 SUSE bug 1182968 SUSE bug 1182975 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha. Moderate CVE-2021-3421 SUSE bug 1183543 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. Moderate CVE-2021-3426 SUSE bug 1183374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat. Low CVE-2021-3428 SUSE bug 1173485 SUSE bug 1183509 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execution, compromised integrity, or denial of service. Important CVE-2021-34401 SUSE bug 1194896 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service, Information disclosure, loss of Integrity, or possible escalation of privileges. Moderate CVE-2021-34402 SUSE bug 1194894 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free condition, leading to code privilege escalation, loss of confidentiality and integrity, or denial of service. Important CVE-2021-34403 SUSE bug 1194897 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a system reboot. Low CVE-2021-34406 SUSE bug 1194893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101. Moderate CVE-2021-3444 SUSE bug 1184170 SUSE bug 1184171 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Moderate CVE-2021-3446 SUSE bug 1183729 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity. Low CVE-2021-3448 SUSE bug 1183709 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). Important CVE-2021-3449 SUSE bug 1183852 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j). Important CVE-2021-3450 SUSE bug 1183851 SUSE bug 1188549 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack. Moderate CVE-2021-34556 SUSE bug 1188983 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered. Moderate CVE-2021-3468 SUSE bug 1184521 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. Moderate CVE-2021-34693 SUSE bug 1187452 SUSE bug 1192868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected Moderate CVE-2021-3483 SUSE bug 1184393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689. Important CVE-2021-34866 SUSE bug 1191645 SUSE bug 1191646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1). Important CVE-2021-3489 SUSE bug 1185640 SUSE bug 1185856 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1). Important CVE-2021-3490 SUSE bug 1185641 SUSE bug 1185796 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1). Important CVE-2021-3491 SUSE bug 1185642 SUSE bug 1187090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562. Moderate CVE-2021-3492 SUSE bug 1184944 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges. Important CVE-2021-3493 SUSE bug 1184900 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2021-34981 SUSE bug 1191961 SUSE bug 1192595 SUSE bug 1196722 SUSE bug 1212298 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability. Important CVE-2021-3501 SUSE bug 1185380 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument. Important CVE-2021-35039 SUSE bug 1188080 SUSE bug 1188126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3504 SUSE bug 1185013 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality. Low CVE-2021-3505 SUSE bug 1184939 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3506 SUSE bug 1184999 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory. Moderate CVE-2021-3507 SUSE bug 1185000 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability. Important CVE-2021-3509 SUSE bug 1186021 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability. Moderate CVE-2021-3516 SUSE bug 1185409 SUSE bug 1191860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. Important CVE-2021-3517 SUSE bug 1185410 SUSE bug 1191860 SUSE bug 1194438 SUSE bug 1196383 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. Moderate CVE-2021-3518 SUSE bug 1185408 SUSE bug 1191860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well. Important CVE-2021-3520 SUSE bug 1185438 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. Moderate CVE-2021-3522 SUSE bug 1185448 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created. Moderate CVE-2021-3524 SUSE bug 1185619 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service. Low CVE-2021-3527 SUSE bug 1186012 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability. Important CVE-2021-3531 SUSE bug 1186020 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability. Important CVE-2021-3537 SUSE bug 1185698 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. Moderate CVE-2021-3541 SUSE bug 1186015 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2021-3542 SUSE bug 1184673 SUSE bug 1186063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system. Important CVE-2021-3543 SUSE bug 1185091 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. Moderate CVE-2021-3544 SUSE bug 1186010 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host. Moderate CVE-2021-3545 SUSE bug 1185990 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command from the guest. It could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition, or potential code execution with the privileges of the QEMU process. Moderate CVE-2021-3546 SUSE bug 1185981 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value. Moderate CVE-2021-35477 SUSE bug 1188985 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-3560 SUSE bug 1186497 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. Moderate CVE-2021-3572 SUSE bug 1186819 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. Important CVE-2021-3573 SUSE bug 1186666 SUSE bug 1187054 SUSE bug 1188172 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service. Important CVE-2021-3580 SUSE bug 1187060 SUSE bug 1187892 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability. Low CVE-2021-3582 SUSE bug 1187499 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. Low CVE-2021-3592 SUSE bug 1187364 SUSE bug 1187369 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. Low CVE-2021-3593 SUSE bug 1187365 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. Low CVE-2021-3594 SUSE bug 1187367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations. Moderate CVE-2021-35942 SUSE bug 1187911 SUSE bug 1192788 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. Low CVE-2021-3595 SUSE bug 1187366 SUSE bug 1187376 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). Moderate CVE-2021-3602 SUSE bug 1188520 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Low CVE-2021-3607 SUSE bug 1187539 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability. Low CVE-2021-3608 SUSE bug 1187538 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root. Moderate CVE-2021-3609 SUSE bug 1187215 SUSE bug 1188323 SUSE bug 1188720 SUSE bug 1190276 SUSE bug 1196810 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0. Moderate CVE-2021-3611 SUSE bug 1187529 SUSE bug 1193914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Low CVE-2021-3612 SUSE bug 1187585 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Moderate CVE-2021-3621 SUSE bug 1189492 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3622 SUSE bug 1189060 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation. Important CVE-2021-36222 SUSE bug 1188571 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3623 SUSE bug 1187767 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity. Moderate CVE-2021-3631 SUSE bug 1187871 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. Low CVE-2021-3638 SUSE bug 1188609 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system. Important CVE-2021-3640 SUSE bug 1188172 SUSE bug 1188613 SUSE bug 1191530 SUSE bug 1196810 SUSE bug 1196914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7. Important CVE-2021-3653 SUSE bug 1189399 SUSE bug 1189420 SUSE bug 1196914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory. Low CVE-2021-3655 SUSE bug 1188563 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. Important CVE-2021-3656 SUSE bug 1189400 SUSE bug 1189418 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3659 SUSE bug 1188876 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3667 SUSE bug 1188843 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS. Moderate CVE-2021-3669 SUSE bug 1188986 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library. Moderate CVE-2021-36690 SUSE bug 1189802 SUSE bug 1211963 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 MaxQueryDuration not honoured in Samba AD DC LDAP Moderate CVE-2021-3670 SUSE bug 1198397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability. Important CVE-2021-3672 SUSE bug 1188881 SUSE bug 1193099 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service. Moderate CVE-2021-3679 SUSE bug 1189057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host. Moderate CVE-2021-3682 SUSE bug 1189145 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12. Important CVE-2021-3695 SUSE bug 1191184 SUSE bug 1203445 SUSE bug 1205057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12. Moderate CVE-2021-3696 SUSE bug 1191185 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12. Important CVE-2021-3697 SUSE bug 1191186 SUSE bug 1203445 SUSE bug 1205057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Critical CVE-2021-3711 SUSE bug 1189520 SUSE bug 1190129 SUSE bug 1192100 SUSE bug 1205663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). Moderate CVE-2021-3712 SUSE bug 1189521 SUSE bug 1190129 SUSE bug 1191640 SUSE bug 1192100 SUSE bug 1192787 SUSE bug 1194948 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host. Important CVE-2021-3713 SUSE bug 1189702 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-3715 SUSE bug 1190349 SUSE bug 1190350 SUSE bug 1196722 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free. Moderate CVE-2021-37159 SUSE bug 1188601 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible. Low CVE-2021-3732 SUSE bug 1189706 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. Low CVE-2021-3733 SUSE bug 1189287 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3735 SUSE bug 1189886 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information. Low CVE-2021-3736 SUSE bug 1192345 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3737 SUSE bug 1189241 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access. Important CVE-2021-3738 SUSE bug 1192215 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3739 SUSE bug 1189832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3743 SUSE bug 1189883 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808. Moderate CVE-2021-3744 SUSE bug 1189884 SUSE bug 1190534 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6. Important CVE-2021-3746 SUSE bug 1189935 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process. Moderate CVE-2021-3748 SUSE bug 1189938 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0. Important CVE-2021-3750 SUSE bug 1190011 SUSE bug 1190015 SUSE bug 1193880 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-3752 SUSE bug 1190023 SUSE bug 1190432 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality. Low CVE-2021-3753 SUSE bug 1190025 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. Important CVE-2021-37576 SUSE bug 1188838 SUSE bug 1188842 SUSE bug 1190276 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3759 SUSE bug 1190115 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability. Moderate CVE-2021-3760 SUSE bug 1190067 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments. Moderate CVE-2021-37600 SUSE bug 1188921 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3764 SUSE bug 1190534 SUSE bug 1194518 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. Moderate CVE-2021-3772 SUSE bug 1190351 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. Moderate CVE-2021-37750 SUSE bug 1189929 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Moderate CVE-2021-3778 SUSE bug 1190533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time. Moderate CVE-2021-3782 SUSE bug 1190486 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Use After Free Moderate CVE-2021-3796 SUSE bug 1190570 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition. Moderate CVE-2021-3800 SUSE bug 1191489 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior. Moderate CVE-2021-38160 SUSE bug 1190117 SUSE bug 1190118 SUSE bug 1196914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability. Moderate CVE-2021-38166 SUSE bug 1189233 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data. Important CVE-2021-38185 SUSE bug 1189206 SUSE bug 1189486 SUSE bug 1192364 SUSE bug 1193391 SUSE bug 1200733 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. Low CVE-2021-38191 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault. Important CVE-2021-38198 SUSE bug 1189262 SUSE bug 1189278 SUSE bug 1196914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command. Moderate CVE-2021-38200 SUSE bug 1189276 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations. Important CVE-2021-38201 SUSE bug 1189288 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. Important CVE-2021-38202 SUSE bug 1189289 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info. Moderate CVE-2021-38203 SUSE bug 1189290 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations. Moderate CVE-2021-38204 SUSE bug 1189291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer). Low CVE-2021-38205 SUSE bug 1189292 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates. Moderate CVE-2021-38206 SUSE bug 1189296 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes. Moderate CVE-2021-38207 SUSE bug 1189298 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call. Moderate CVE-2021-38208 SUSE bug 1187055 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. Low CVE-2021-38209 SUSE bug 1189393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture. Important CVE-2021-38300 SUSE bug 1190427 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack. Important CVE-2021-38561 SUSE bug 1206711 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. Important CVE-2021-38578 SUSE bug 1196741 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges. Important CVE-2021-3864 SUSE bug 1191281 SUSE bug 1192449 SUSE bug 1205059 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Important CVE-2021-3872 SUSE bug 1191893 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Important CVE-2021-3875 SUSE bug 1191770 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43389. Reason: This candidate is a reservation duplicate of CVE-2021-43389. Notes: All CVE users should reference CVE-2021-43389 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2021-3896 SUSE bug 1191958 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Moderate CVE-2021-3903 SUSE bug 1192167 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. Low CVE-2021-3923 SUSE bug 1209778 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Moderate CVE-2021-3927 SUSE bug 1192481 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Use of Uninitialized Variable Moderate CVE-2021-3928 SUSE bug 1192478 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host. Important CVE-2021-3929 SUSE bug 1193880 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition. Low CVE-2021-3930 SUSE bug 1192525 SUSE bug 1192526 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow. Moderate CVE-2021-39537 SUSE bug 1190793 SUSE bug 1196626 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-120612905References: Upstream kernel Moderate CVE-2021-39636 SUSE bug 1193812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-160822094References: Upstream kernel Moderate CVE-2021-39648 SUSE bug 1193861 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174049066References: Upstream kernel Moderate CVE-2021-39656 SUSE bug 1193862 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194696049References: Upstream kernel Low CVE-2021-39657 SUSE bug 1193864 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Important CVE-2021-3968 SUSE bug 1192902 SUSE bug 1208308 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel Important CVE-2021-39685 SUSE bug 1193802 SUSE bug 1194459 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel Moderate CVE-2021-39686 SUSE bug 1196954 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel Important CVE-2021-39713 SUSE bug 1196973 SUSE bug 1197211 SUSE bug 1201790 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205573273References: Upstream kernel Important CVE-2021-39714 SUSE bug 1197214 SUSE bug 1197218 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-178379135References: Upstream kernel Moderate CVE-2021-39715 SUSE bug 1197210 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In gasket_free_coherent_memory_all of gasket_page_table.c, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-151454974References: N/A Moderate CVE-2021-39725 SUSE bug 1197206 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Critical CVE-2021-3973 SUSE bug 1192903 SUSE bug 1208308 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In gasket_alloc_coherent_memory of gasket_page_table.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-151455484References: N/A Moderate CVE-2021-39735 SUSE bug 1197205 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Use After Free Moderate CVE-2021-3974 SUSE bug 1192904 SUSE bug 1206818 SUSE bug 1208308 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks. Moderate CVE-2021-3979 SUSE bug 1194131 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In usb_gadget_giveback_request of core.c, there is a possible use after free out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161010552References: Upstream kernel Low CVE-2021-39792 SUSE bug 1197203 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ion_ioctl of ion-ioctl.c, there is a possible way to leak kernel head data due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-208277166References: Upstream kernel Low CVE-2021-39800 SUSE bug 1198444 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ion_ioctl of ion-ioctl.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-209791720References: Upstream kernel Important CVE-2021-39801 SUSE bug 1198443 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In change_pte_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213339151References: Upstream kernel Important CVE-2021-39802 SUSE bug 1198445 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Moderate CVE-2021-3984 SUSE bug 1193298 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. Moderate CVE-2021-3995 SUSE bug 1194976 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. Moderate CVE-2021-3996 SUSE bug 1194976 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. Moderate CVE-2021-3997 SUSE bug 1194178 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system. Important CVE-2021-3999 SUSE bug 1194640 SUSE bug 1196024 SUSE bug 1196389 SUSE bug 1199869 SUSE bug 1200203 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2. Important CVE-2021-4001 SUSE bug 1192990 SUSE bug 1192991 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. Moderate CVE-2021-4002 SUSE bug 1192946 SUSE bug 1192973 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Moderate CVE-2021-4019 SUSE bug 1193294 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operation triggers the submission of new io-uring operations during a shortage of free space. This flaw allows a local user with permissions to execute io-uring requests to possibly crash the system. Moderate CVE-2021-4023 SUSE bug 1193107 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. Moderate CVE-2021-4024 SUSE bug 1193166 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system. Important CVE-2021-4028 SUSE bug 1193167 SUSE bug 1193529 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction, which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7. Moderate CVE-2021-4032 SUSE bug 1193187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. Important CVE-2021-4034 SUSE bug 1194568 SUSE bug 1195125 SUSE bug 1195136 SUSE bug 1195246 SUSE bug 1195265 SUSE bug 1195278 SUSE bug 1195528 SUSE bug 1195541 SUSE bug 1196165 SUSE bug 1196388 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. Moderate CVE-2021-4037 SUSE bug 1198702 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13. Moderate CVE-2021-40490 SUSE bug 1190159 SUSE bug 1192775 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Use After Free Moderate CVE-2021-4069 SUSE bug 1193466 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4. Important CVE-2021-4083 SUSE bug 1193727 SUSE bug 1194460 SUSE bug 1196722 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. Moderate CVE-2021-4090 SUSE bug 1193663 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario. Important CVE-2021-4093 SUSE bug 1193716 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1. Moderate CVE-2021-4095 SUSE bug 1193769 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation. Important CVE-2021-41073 SUSE bug 1190664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted. Moderate CVE-2021-41089 SUSE bug 1191015 SUSE bug 1191355 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers. Moderate CVE-2021-41091 SUSE bug 1191355 SUSE bug 1191434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH. Moderate CVE-2021-41092 SUSE bug 1191334 SUSE bug 1191355 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories. Moderate CVE-2021-41103 SUSE bug 1191121 SUSE bug 1191355 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned Low CVE-2021-4115 SUSE bug 1195542 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec. Moderate CVE-2021-41190 SUSE bug 1193273 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium. Moderate CVE-2021-4122 SUSE bug 1194469 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data. Moderate CVE-2021-4135 SUSE bug 1193927 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Important CVE-2021-4136 SUSE bug 1193905 SUSE bug 1208308 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition. Important CVE-2021-4147 SUSE bug 1194041 SUSE bug 1194313 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with user privilege to cause a denial of service (DOS) problem. Moderate CVE-2021-4148 SUSE bug 1193983 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. Moderate CVE-2021-4149 SUSE bug 1194001 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk. Moderate CVE-2021-4150 SUSE bug 1193994 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system. Important CVE-2021-4154 SUSE bug 1193842 SUSE bug 1194461 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. Moderate CVE-2021-4155 SUSE bug 1194272 SUSE bug 1199255 SUSE bug 1200084 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system. Low CVE-2021-4157 SUSE bug 1194013 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Moderate CVE-2021-41617 SUSE bug 1190975 SUSE bug 1193497 SUSE bug 1196721 SUSE bug 1200782 SUSE bug 1205056 SUSE bug 1212247 SUSE bug 1212281 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Out-of-bounds Read Moderate CVE-2021-4166 SUSE bug 1194093 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write. Important CVE-2021-41864 SUSE bug 1191317 SUSE bug 1191318 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Use After Free Moderate CVE-2021-4192 SUSE bug 1194217 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Out-of-bounds Read Low CVE-2021-4193 SUSE bug 1194216 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system. Moderate CVE-2021-4197 SUSE bug 1194302 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access. Important CVE-2021-42008 SUSE bug 1191315 SUSE bug 1191660 SUSE bug 1196722 SUSE bug 1196810 SUSE bug 1196914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem. Moderate CVE-2021-4202 SUSE bug 1194529 SUSE bug 1194533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information. Moderate CVE-2021-4203 SUSE bug 1194535 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information. Moderate CVE-2021-4204 SUSE bug 1194111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process. Important CVE-2021-4206 SUSE bug 1198035 SUSE bug 1211582 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process. Important CVE-2021-4207 SUSE bug 1198037 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances. Moderate CVE-2021-4209 SUSE bug 1196167 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local attacker with local access to cause a denial of service while the system reboots. The issue is specific to CentOS/RHEL. Moderate CVE-2021-4218 SUSE bug 1195374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes. Important CVE-2021-42252 SUSE bug 1190479 SUSE bug 1192444 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it. Low CVE-2021-42523 SUSE bug 1202802 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or escalate privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-42739 SUSE bug 1184673 SUSE bug 1192036 SUSE bug 1196722 SUSE bug 1196914 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. Important CVE-2021-42771 SUSE bug 1185768 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register values. Moderate CVE-2021-43056 SUSE bug 1192107 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task. Important CVE-2021-43057 SUSE bug 1192260 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2021-43085 SUSE bug 1197505 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type. Critical CVE-2021-43267 SUSE bug 1192341 SUSE bug 1195254 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. Moderate CVE-2021-43389 SUSE bug 1191958 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file. Low CVE-2021-43519 SUSE bug 1192613 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1. Important CVE-2021-43527 SUSE bug 1193170 SUSE bug 1193331 SUSE bug 1193378 SUSE bug 1194288 SUSE bug 1199301 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. Important CVE-2021-43565 SUSE bug 1193930 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed. Moderate CVE-2021-43566 SUSE bug 1139519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. Moderate CVE-2021-43618 SUSE bug 1192717 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug. Moderate CVE-2021-43784 SUSE bug 1193436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. Moderate CVE-2021-43975 SUSE bug 1192845 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic). Moderate CVE-2021-43976 SUSE bug 1192847 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed. Moderate CVE-2021-44141 SUSE bug 1193690 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. Critical CVE-2021-44142 SUSE bug 1194859 SUSE bug 1195611 SUSE bug 1196455 SUSE bug 1199646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. Important CVE-2021-44648 SUSE bug 1194633 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object. Moderate CVE-2021-44733 SUSE bug 1193767 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak. Moderate CVE-2021-45095 SUSE bug 1193867 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. This occurs because it sets the SMB2_GLOBAL_CAP_ENCRYPTION flag when using the SMB 3.1.1 protocol, which is a violation of the SMB protocol specification. When Windows 10 detects this protocol violation, it disables encryption. Important CVE-2021-45100 SUSE bug 1193865 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. Moderate CVE-2021-45417 SUSE bug 1194735 SUSE bug 1196390 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry. Important CVE-2021-45469 SUSE bug 1194060 SUSE bug 1194462 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances. Low CVE-2021-45480 SUSE bug 1194090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses. Low CVE-2021-45485 SUSE bug 1194094 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small. Low CVE-2021-45486 SUSE bug 1194087 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption. Low CVE-2021-45710 SUSE bug 1194119 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file. Moderate CVE-2021-45868 SUSE bug 1197366 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). Moderate CVE-2021-45960 SUSE bug 1194251 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. Moderate CVE-2021-45985 SUSE bug 1210274 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2021-46059 SUSE bug 1194556 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Important CVE-2021-46143 SUSE bug 1194362 SUSE bug 1195327 SUSE bug 1196387 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace. Moderate CVE-2021-46283 SUSE bug 1194518 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time. Moderate CVE-2021-46744 SUSE bug 1199470 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c. Moderate CVE-2021-46822 SUSE bug 1200720 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections. Important CVE-2021-46828 SUSE bug 1201680 SUSE bug 1206259 SUSE bug 1209708 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems. Moderate CVE-2021-46829 SUSE bug 1201826 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. Critical CVE-2021-46848 SUSE bug 1204690 SUSE bug 1205081 SUSE bug 1205311 SUSE bug 1208025 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Out-of-bounds Read Low CVE-2022-0128 SUSE bug 1194388 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution. Important CVE-2022-0135 SUSE bug 1195389 SUSE bug 1196396 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system. Moderate CVE-2022-0168 SUSE bug 1197472 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure. Moderate CVE-2022-0175 SUSE bug 1194601 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. Important CVE-2022-0185 SUSE bug 1194517 SUSE bug 1194737 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 vim is vulnerable to Heap-based Buffer Overflow Moderate CVE-2022-0213 SUSE bug 1194885 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service. Moderate CVE-2022-0216 SUSE bug 1198038 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-0261 SUSE bug 1194872 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6 Moderate CVE-2022-0264 SUSE bug 1194826 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service. Moderate CVE-2022-0286 SUSE bug 1195371 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in vim/vim prior to 8.2. Moderate CVE-2022-0318 SUSE bug 1195004 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in vim/vim prior to 8.2. Low CVE-2022-0319 SUSE bug 1195066 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). Moderate CVE-2022-0322 SUSE bug 1194985 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. Moderate CVE-2022-0330 SUSE bug 1194880 SUSE bug 1195950 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity. Important CVE-2022-0336 SUSE bug 1195048 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. Low CVE-2022-0351 SUSE bug 1195126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system. Moderate CVE-2022-0358 SUSE bug 1195161 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-0359 SUSE bug 1195203 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-0361 SUSE bug 1195202 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1. Moderate CVE-2022-0382 SUSE bug 1195199 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. Moderate CVE-2022-0392 SUSE bug 1195332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Important CVE-2022-0407 SUSE bug 1195354 SUSE bug 1208308 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 8.2. Important CVE-2022-0413 SUSE bug 1195356 SUSE bug 1208308 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1. Moderate CVE-2022-0433 SUSE bug 1195373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality. Moderate CVE-2022-0494 SUSE bug 1197386 SUSE bug 1207783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. Important CVE-2022-0500 SUSE bug 1196261 SUSE bug 1196811 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. Moderate CVE-2022-0561 SUSE bug 1195964 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c. Moderate CVE-2022-0562 SUSE bug 1195965 SUSE bug 1201723 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system. Important CVE-2022-0615 SUSE bug 1196541 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5. Moderate CVE-2022-0646 SUSE bug 1196090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2. Important CVE-2022-0670 SUSE bug 1201837 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428. Low CVE-2022-0696 SUSE bug 1196361 SUSE bug 1205395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc. Important CVE-2022-0742 SUSE bug 1197128 SUSE bug 1197129 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). Important CVE-2022-0778 SUSE bug 1196877 SUSE bug 1197328 SUSE bug 1197340 SUSE bug 1199100 SUSE bug 1199254 SUSE bug 1199303 SUSE bug 1199339 SUSE bug 1200090 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user privileges to leak kernel information. Moderate CVE-2022-0812 SUSE bug 1196639 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace. Moderate CVE-2022-0850 SUSE bug 1196761 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space. Moderate CVE-2022-0854 SUSE bug 1196823 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045. Moderate CVE-2022-0865 SUSE bug 1197066 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact Important CVE-2022-0891 SUSE bug 1197068 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd). Moderate CVE-2022-0897 SUSE bug 1197636 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. Moderate CVE-2022-0908 SUSE bug 1197074 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa. Moderate CVE-2022-0909 SUSE bug 1197072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4. Moderate CVE-2022-0924 SUSE bug 1197073 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service. Moderate CVE-2022-0934 SUSE bug 1197872 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system. Important CVE-2022-0995 SUSE bug 1197246 SUSE bug 1197337 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-0998 SUSE bug 1197247 SUSE bug 1197338 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. Moderate CVE-2022-1011 SUSE bug 1197343 SUSE bug 1197344 SUSE bug 1198687 SUSE bug 1204132 SUSE bug 1212322 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem. Moderate CVE-2022-1012 SUSE bug 1199482 SUSE bug 1199694 SUSE bug 1202335 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. Important CVE-2022-1016 SUSE bug 1197335 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, crash the system or escalate privileges. Important CVE-2022-1043 SUSE bug 1197393 SUSE bug 1197596 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-1048 SUSE bug 1197331 SUSE bug 1197597 SUSE bug 1200041 SUSE bug 1204132 SUSE bug 1212325 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition. Important CVE-2022-1050 SUSE bug 1197653 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 Important CVE-2022-1055 SUSE bug 1197702 SUSE bug 1197705 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd. Important CVE-2022-1056 SUSE bug 1197631 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Important CVE-2022-1097 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions. Important CVE-2022-1116 SUSE bug 1199647 SUSE bug 1199648 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. Important CVE-2022-1158 SUSE bug 1197660 SUSE bug 1198133 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. Moderate CVE-2022-1184 SUSE bug 1198577 SUSE bug 1210859 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early. Moderate CVE-2022-1195 SUSE bug 1198029 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space. Moderate CVE-2022-1198 SUSE bug 1198030 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability. Moderate CVE-2022-1199 SUSE bug 1198028 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system. Moderate CVE-2022-1205 SUSE bug 1198027 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service. Important CVE-2022-1227 SUSE bug 1182428 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and removes neighbours only if their “count” and “use” are zero. Moderate CVE-2022-1247 SUSE bug 1199434 SUSE bug 1199696 SUSE bug 1204132 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. Moderate CVE-2022-1263 SUSE bug 1198189 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system. Important CVE-2022-1271 SUSE bug 1198062 SUSE bug 1198812 SUSE bug 1199107 SUSE bug 1199108 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak. Moderate CVE-2022-1280 SUSE bug 1197914 SUSE bug 1198590 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). Moderate CVE-2022-1292 SUSE bug 1199166 SUSE bug 1200550 SUSE bug 1200650 SUSE bug 1200758 SUSE bug 1202688 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem. Moderate CVE-2022-1304 SUSE bug 1198446 SUSE bug 1201130 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Moderate CVE-2022-1343 SUSE bug 1199167 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0. Moderate CVE-2022-1348 SUSE bug 1199652 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. Moderate CVE-2022-1353 SUSE bug 1198516 SUSE bug 1212293 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service. Moderate CVE-2022-1354 SUSE bug 1198519 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service. Moderate CVE-2022-1355 SUSE bug 1198520 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Moderate CVE-2022-1381 SUSE bug 1198596 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object. Moderate CVE-2022-1419 SUSE bug 1198742 SUSE bug 1201655 SUSE bug 1203034 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. Low CVE-2022-1420 SUSE bug 1198748 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore, in such a case, only an OpenSSL 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. If both endpoints are OpenSSL 3.0 then the attacker could modify data being sent in both directions. In this case both clients and servers could be affected, regardless of the application protocol. Note that in the absence of an attacker this bug means that an OpenSSL 3.0 endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete the handshake when using this ciphersuite. The confidentiality of data is not impacted by this issue, i.e. an attacker cannot decrypt data that has been encrypted using this ciphersuite - they can only modify it. In order for this attack to work both endpoints must legitimately negotiate the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in OpenSSL 3.0, and is not available within the default provider or the default ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the following must have occurred: 1) OpenSSL must have been compiled with the (non-default) compile time option enable-weak-ssl-ciphers 2) OpenSSL must have had the legacy provider explicitly loaded (either through application code or via configuration) 3) The ciphersuite must have been explicitly added to the ciphersuite list 4) The libssl security level must have been set to 0 (default is 1) 5) A version of SSL/TLS below TLSv1.3 must have been negotiated 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any others that both endpoints have in common Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Important CVE-2022-1434 SUSE bug 1199168 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory. Moderate CVE-2022-1462 SUSE bug 1198829 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Important CVE-2022-1473 SUSE bug 1199168 SUSE bug 1199169 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This flaw allows a local user to read some memory out of bounds. Moderate CVE-2022-1508 SUSE bug 1198968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system. Moderate CVE-2022-1516 SUSE bug 1199012 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. Important CVE-2022-1586 SUSE bug 1199232 SUSE bug 1203032 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. Important CVE-2022-1587 SUSE bug 1199235 SUSE bug 1201754 SUSE bug 1203032 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. Important CVE-2022-1615 SUSE bug 1202976 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Moderate CVE-2022-1616 SUSE bug 1199331 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution Moderate CVE-2022-1619 SUSE bug 1199333 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input. Low CVE-2022-1620 SUSE bug 1199334 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Moderate CVE-2022-1621 SUSE bug 1199435 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. Moderate CVE-2022-1622 SUSE bug 1199483 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. Moderate CVE-2022-1623 SUSE bug 1199484 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution Moderate CVE-2022-1629 SUSE bug 1199436 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to leak unauthorized kernel information, causing a denial of service. Moderate CVE-2022-1651 SUSE bug 1199433 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. Moderate CVE-2022-1652 SUSE bug 1199063 SUSE bug 1200057 SUSE bug 1200751 SUSE bug 1201832 SUSE bug 1204132 SUSE bug 1212307 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs. Low CVE-2022-1664 SUSE bug 1199944 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information. Moderate CVE-2022-1671 SUSE bug 1199439 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input. Low CVE-2022-1674 SUSE bug 1199502 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients. Moderate CVE-2022-1678 SUSE bug 1199939 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-1679 SUSE bug 1199487 SUSE bug 1201080 SUSE bug 1201832 SUSE bug 1204132 SUSE bug 1212316 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config. Moderate CVE-2022-1706 SUSE bug 1199524 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability. Moderate CVE-2022-1708 SUSE bug 1200285 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution. Low CVE-2022-1720 SUSE bug 1200732 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. Moderate CVE-2022-1725 SUSE bug 1204118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. Important CVE-2022-1729 SUSE bug 1199507 SUSE bug 1199697 SUSE bug 1201832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968. Low CVE-2022-1733 SUSE bug 1199655 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969. Moderate CVE-2022-1735 SUSE bug 1199651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. Moderate CVE-2022-1769 SUSE bug 1199658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. Low CVE-2022-1771 SUSE bug 1199693 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977. Low CVE-2022-1785 SUSE bug 1199745 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference. Moderate CVE-2022-1789 SUSE bug 1199674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 8.2.4979. Moderate CVE-2022-1796 SUSE bug 1199747 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Low CVE-2022-1851 SUSE bug 1199936 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU. Moderate CVE-2022-1852 SUSE bug 1199875 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-1882 SUSE bug 1199904 SUSE bug 1200058 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Low CVE-2022-1886 SUSE bug 1199969 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-1897 SUSE bug 1200010 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-1898 SUSE bug 1200011 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Over-read in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-1927 SUSE bug 1200012 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated. Moderate CVE-2022-1941 SUSE bug 1203681 SUSE bug 1205141 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-1942 SUSE bug 1200125 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udf_write_fi(). A local user could use this flaw to crash the system or potentially Moderate CVE-2022-1943 SUSE bug 1200055 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2022-1966 SUSE bug 1200015 SUSE bug 1200268 SUSE bug 1200494 SUSE bug 1200529 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-1968 SUSE bug 1200270 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2078. Reason: This candidate is a reservation duplicate of CVE-2022-2078. Notes: All CVE users should reference CVE-2022-2078 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2022-1972 SUSE bug 1200019 SUSE bug 1200266 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and leads to a kernel information leak problem. Important CVE-2022-1973 SUSE bug 1200023 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information. Moderate CVE-2022-1974 SUSE bug 1200144 SUSE bug 1200265 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space. Moderate CVE-2022-1975 SUSE bug 1200143 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2022-1998 SUSE bug 1200284 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Important CVE-2022-2000 SUSE bug 1200405 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel Moderate CVE-2022-20008 SUSE bug 1199564 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-217475903References: N/A Low CVE-2022-20117 SUSE bug 1199569 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ion_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205707793References: N/A Moderate CVE-2022-20118 SUSE bug 1199570 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213170715References: N/A Low CVE-2022-20119 SUSE bug 1199563 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel Moderate CVE-2022-20132 SUSE bug 1200619 SUSE bug 1212287 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel Moderate CVE-2022-20141 SUSE bug 1200604 SUSE bug 1200605 SUSE bug 1203034 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In TBD of TBD, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219513976References: Upstream kernel Moderate CVE-2022-20148 SUSE bug 1200610 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222091980References: Upstream kernel Moderate CVE-2022-20153 SUSE bug 1200609 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel Moderate CVE-2022-20154 SUSE bug 1200599 SUSE bug 1200608 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182815710References: Upstream kernel Moderate CVE-2022-20158 SUSE bug 1202345 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel Moderate CVE-2022-20166 SUSE bug 1200598 SUSE bug 1212284 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services. Important CVE-2022-2031 SUSE bug 1201495 SUSE bug 1202815 SUSE bug 1202999 SUSE bug 1205061 SUSE bug 1208433 SUSE bug 1209664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel Moderate CVE-2022-20368 SUSE bug 1202346 SUSE bug 1212311 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-223375145References: Upstream kernel Moderate CVE-2022-20369 SUSE bug 1202347 SUSE bug 1212321 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In dm_bow_dtr and related functions of dm-bow.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195565510References: Upstream kernel Moderate CVE-2022-20371 SUSE bug 1202348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In (TBD) of (TBD), there is a possible out of bounds write due to kernel stack overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-214245176References: Upstream kernel Moderate CVE-2022-20382 SUSE bug 1202349 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 8.2. Important CVE-2022-2042 SUSE bug 1200471 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel Important CVE-2022-20421 SUSE bug 1204984 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Low CVE-2022-2056 SUSE bug 1201176 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Low CVE-2022-2057 SUSE bug 1201175 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Low CVE-2022-2058 SUSE bug 1201174 SUSE bug 1201175 SUSE bug 1201176 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). Moderate CVE-2022-2068 SUSE bug 1200550 SUSE bug 1207568 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p). Important CVE-2022-2097 SUSE bug 1201099 SUSE bug 1201332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21123 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209075 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21125 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209074 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21127 SUSE bug 1199650 SUSE bug 1200549 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21151 SUSE bug 1199423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21166 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209073 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access. Moderate CVE-2022-21180 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1212313 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network access. Important CVE-2022-21216 SUSE bug 1208277 SUSE bug 1209936 SUSE bug 1211490 SUSE bug 1211511 SUSE bug 1213820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2022-21233 SUSE bug 1201727 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Over-read in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2124 SUSE bug 1200697 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2125 SUSE bug 1200698 SUSE bug 1205395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2126 SUSE bug 1200700 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash. Moderate CVE-2022-2127 SUSE bug 1213174 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2129 SUSE bug 1200701 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a socket to be closed and freed while it was still in use by another portion of the kernel. An attack with local access can operate on the socket, and cause a denial of service. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2022-21504 SUSE bug 1200545 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-21505 SUSE bug 1201458 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. Moderate CVE-2022-2153 SUSE bug 1200788 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. Important CVE-2022-21698 SUSE bug 1196338 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer Over-read in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2175 SUSE bug 1200904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2182 SUSE bug 1200903 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2183 SUSE bug 1200902 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.?L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB?after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit?2e7eab81425a Moderate CVE-2022-2196 SUSE bug 1206992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Important CVE-2022-22058 SUSE bug 1203777 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2206 SUSE bug 1201155 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2207 SUSE bug 1201153 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Information Disclosure in Graphics during GPU context switch. Moderate CVE-2022-22075 SUSE bug 1209195 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. Low CVE-2022-2208 SUSE bug 1201152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2022-2209 SUSE bug 1201828 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2210 SUSE bug 1201151 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or malicious actor. Moderate CVE-2022-2211 SUSE bug 1201064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2231 SUSE bug 1201150 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2257 SUSE bug 1201154 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). Moderate CVE-2022-22576 SUSE bug 1198614 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2264 SUSE bug 1201132 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. Critical CVE-2022-2274 SUSE bug 1201148 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22822 SUSE bug 1194474 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22823 SUSE bug 1194476 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22824 SUSE bug 1194477 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22825 SUSE bug 1194478 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22826 SUSE bug 1194479 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22827 SUSE bug 1194480 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2284 SUSE bug 1201133 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. Moderate CVE-2022-22844 SUSE bug 1194539 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. Moderate CVE-2022-2285 SUSE bug 1201134 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2286 SUSE bug 1201135 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2287 SUSE bug 1201136 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 9.0. Moderate CVE-2022-2288 SUSE bug 1201137 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0. Moderate CVE-2022-2289 SUSE bug 1201139 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data. Important CVE-2022-22934 SUSE bug 1197417 SUSE bug 1197765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master. Important CVE-2022-22935 SUSE bug 1197417 SUSE bug 1197765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios. Important CVE-2022-22936 SUSE bug 1197417 SUSE bug 1197765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion. Important CVE-2022-22941 SUSE bug 1197417 SUSE bug 1197765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-22942 SUSE bug 1195065 SUSE bug 1195951 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth. Important CVE-2022-22967 SUSE bug 1200566 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes. Important CVE-2022-23033 SUSE bug 1194576 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be decremented twice. Underflow of the counters gets detected, resulting in the triggering of a hypervisor bug check. Low CVE-2022-23034 SUSE bug 1194581 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved, this scheduling of a retry may get erroneously skipped. At the same time pointers may get cleared (resulting in a de-reference of NULL) and freed (resulting in a use-after-free), while other code would continue to assume them to be valid. Moderate CVE-2022-23035 SUSE bug 1194588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Moderate CVE-2022-2304 SUSE bug 1201249 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers. Moderate CVE-2022-2308 SUSE bug 1202573 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges. Moderate CVE-2022-2318 SUSE bug 1201251 SUSE bug 1212303 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. Moderate CVE-2022-23218 SUSE bug 1194770 SUSE bug 1199869 SUSE bug 1200036 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. Moderate CVE-2022-23219 SUSE bug 1194768 SUSE bug 1199869 SUSE bug 1200036 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types. Moderate CVE-2022-23222 SUSE bug 1194765 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 Moderate CVE-2022-2327 SUSE bug 1201829 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494. Important CVE-2022-23303 SUSE bug 1194732 SUSE bug 1205064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495. Important CVE-2022-23304 SUSE bug 1194733 SUSE bug 1205064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. Moderate CVE-2022-23308 SUSE bug 1196490 SUSE bug 1199098 SUSE bug 1202688 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. Moderate CVE-2022-2343 SUSE bug 1201356 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. Moderate CVE-2022-2344 SUSE bug 1201359 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0046. Moderate CVE-2022-2345 SUSE bug 1201363 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. Moderate CVE-2022-23471 SUSE bug 1206235 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. Moderate CVE-2022-23491 SUSE bug 1206212 SUSE bug 1207038 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue. Moderate CVE-2022-23648 SUSE bug 1196441 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel. Moderate CVE-2022-2380 SUSE bug 1201378 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none. Moderate CVE-2022-23816 SUSE bug 1201456 SUSE bug 1201469 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. Moderate CVE-2022-23824 SUSE bug 1205209 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. Moderate CVE-2022-23825 SUSE bug 1201457 SUSE bug 1201469 SUSE bug 1205209 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. Important CVE-2022-23852 SUSE bug 1195054 SUSE bug 1196480 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. Important CVE-2022-23990 SUSE bug 1195217 SUSE bug 1196480 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace. Important CVE-2022-24122 SUSE bug 1195306 SUSE bug 1196028 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. Important CVE-2022-24407 SUSE bug 1196036 SUSE bug 1198600 SUSE bug 1199112 SUSE bug 1199494 SUSE bug 1200197 SUSE bug 1200200 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting. Moderate CVE-2022-24769 SUSE bug 1197517 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL. Moderate CVE-2022-24795 SUSE bug 1198405 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5 Moderate CVE-2022-2503 SUSE bug 1202677 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function. Important CVE-2022-2509 SUSE bug 1202020 SUSE bug 1202593 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 Important CVE-2022-2519 SUSE bug 1202968 SUSE bug 1205505 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. Moderate CVE-2022-2520 SUSE bug 1202973 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. Important CVE-2022-2521 SUSE bug 1202971 SUSE bug 1205505 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. Low CVE-2022-2522 SUSE bug 1201863 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Important CVE-2022-25236 SUSE bug 1196025 SUSE bug 1196784 SUSE bug 1197217 SUSE bug 1200038 SUSE bug 1201735 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later. Important CVE-2022-2526 SUSE bug 1202574 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file. Important CVE-2022-25265 SUSE bug 1196134 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service. Moderate CVE-2022-25308 SUSE bug 1196147 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service. Moderate CVE-2022-25309 SUSE bug 1196148 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service. Moderate CVE-2022-25310 SUSE bug 1196150 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101. Moderate CVE-2022-2571 SUSE bug 1202046 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102. Moderate CVE-2022-2580 SUSE bug 1202049 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104. Low CVE-2022-2581 SUSE bug 1202050 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2022-2585 SUSE bug 1202094 SUSE bug 1202163 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-2586 SUSE bug 1202095 SUSE bug 1209719 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2022-2588 SUSE bug 1202096 SUSE bug 1203613 SUSE bug 1204183 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range. Low CVE-2022-25883 SUSE bug 1212565 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system. Important CVE-2022-2590 SUSE bug 1202013 SUSE bug 1202089 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100. Low CVE-2022-2598 SUSE bug 1202051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism. Moderate CVE-2022-2601 SUSE bug 1205178 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2022-2602 SUSE bug 1204228 SUSE bug 1205186 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0. Important CVE-2022-26353 SUSE bug 1198711 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0. Low CVE-2022-26354 SUSE bug 1198712 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak. Moderate CVE-2022-26356 SUSE bug 1197423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed. Moderate CVE-2022-26357 SUSE bug 1197425 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption. Moderate CVE-2022-26358 SUSE bug 1197426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption. Moderate CVE-2022-26359 SUSE bug 1197426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption. Moderate CVE-2022-26360 SUSE bug 1197426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption. Moderate CVE-2022-26361 SUSE bug 1197426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited. Important CVE-2022-26362 SUSE bug 1199965 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe. Important CVE-2022-26363 SUSE bug 1199966 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe. Important CVE-2022-26364 SUSE bug 1199966 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-26365 SUSE bug 1200762 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Moderate CVE-2022-26373 SUSE bug 1201726 SUSE bug 1209619 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-2639 SUSE bug 1202154 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2. Moderate CVE-2022-26488 SUSE bug 1203151 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured. Moderate CVE-2022-2663 SUSE bug 1202097 SUSE bug 1212299 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges. Important CVE-2022-26691 SUSE bug 1199474 SUSE bug 1203785 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed). Low CVE-2022-26878 SUSE bug 1197035 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. Important CVE-2022-27191 SUSE bug 1197284 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access. Moderate CVE-2022-27223 SUSE bug 1197245 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges. Moderate CVE-2022-27239 SUSE bug 1197216 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face. Moderate CVE-2022-27404 SUSE bug 1198830 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request. Moderate CVE-2022-27405 SUSE bug 1198832 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size. Moderate CVE-2022-27406 SUSE bug 1198823 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. Moderate CVE-2022-27649 SUSE bug 1197909 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat. Important CVE-2022-27666 SUSE bug 1197131 SUSE bug 1197133 SUSE bug 1197462 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure. Moderate CVE-2022-27672 SUSE bug 1208286 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead. Moderate CVE-2022-27775 SUSE bug 1198723 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Moderate CVE-2022-27776 SUSE bug 1198766 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. Moderate CVE-2022-27778 SUSE bug 1199220 SUSE bug 1202688 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain. Moderate CVE-2022-27779 SUSE bug 1199221 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more. Moderate CVE-2022-27780 SUSE bug 1199222 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. Low CVE-2022-27781 SUSE bug 1199223 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. Important CVE-2022-27782 SUSE bug 1199224 SUSE bug 1200694 SUSE bug 1203786 SUSE bug 1205070 SUSE bug 1209214 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c Moderate CVE-2022-2785 SUSE bug 1203734 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition. Moderate CVE-2022-27950 SUSE bug 1197646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212. Low CVE-2022-2816 SUSE bug 1202421 SUSE bug 1203576 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0213. Moderate CVE-2022-2817 SUSE bug 1202420 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. Moderate CVE-2022-2819 SUSE bug 1202414 SUSE bug 1203576 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation. Critical CVE-2022-28348 SUSE bug 1199720 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through r23p0 before r24p0. Critical CVE-2022-28349 SUSE bug 1199761 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation. Critical CVE-2022-28350 SUSE bug 1199762 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. Moderate CVE-2022-28356 SUSE bug 1197391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free. Moderate CVE-2022-28388 SUSE bug 1198032 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free. Moderate CVE-2022-28389 SUSE bug 1198033 SUSE bug 1201657 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free. Moderate CVE-2022-28390 SUSE bug 1198031 SUSE bug 1201517 SUSE bug 1207969 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. Low CVE-2022-2845 SUSE bug 1202515 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. Low CVE-2022-2849 SUSE bug 1202512 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0221. Moderate CVE-2022-2862 SUSE bug 1202511 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. Low CVE-2022-2867 SUSE bug 1202466 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. Low CVE-2022-2868 SUSE bug 1202467 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. Low CVE-2022-2869 SUSE bug 1202468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-28693 SUSE bug 1201455 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system. Moderate CVE-2022-2873 SUSE bug 1202558 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer. Important CVE-2022-28733 SUSE bug 1198460 SUSE bug 1203445 SUSE bug 1205057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata. Moderate CVE-2022-28734 SUSE bug 1198493 SUSE bug 1203445 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain. Important CVE-2022-28735 SUSE bug 1198495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved. Important CVE-2022-28736 SUSE bug 1198496 SUSE bug 1203445 SUSE bug 1205057 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario. Important CVE-2022-28737 SUSE bug 1198458 SUSE bug 1205065 SUSE bug 1205066 SUSE bug 1205831 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. Low CVE-2022-2874 SUSE bug 1202552 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Low CVE-2022-28748 SUSE bug 1196018 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition. Moderate CVE-2022-28796 SUSE bug 1198325 SUSE bug 1198594 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code. Moderate CVE-2022-28805 SUSE bug 1198328 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0225. Moderate CVE-2022-2889 SUSE bug 1202599 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state. Moderate CVE-2022-28893 SUSE bug 1198330 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. Moderate CVE-2022-2905 SUSE bug 1202860 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). Important CVE-2022-29154 SUSE bug 1201840 SUSE bug 1202970 SUSE bug 1202998 SUSE bug 1203401 SUSE bug 1203789 SUSE bug 1204119 SUSE bug 1205072 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping. Critical CVE-2022-29155 SUSE bug 1199240 SUSE bug 1202818 SUSE bug 1204120 SUSE bug 1207513 SUSE bug 1208312 SUSE bug 1210149 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release. Moderate CVE-2022-29156 SUSE bug 1198515 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file. Low CVE-2022-29162 SUSE bug 1199460 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. Low CVE-2022-2923 SUSE bug 1202687 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. Moderate CVE-2022-29458 SUSE bug 1198627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0246. Moderate CVE-2022-2946 SUSE bug 1202689 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8. Moderate CVE-2022-2953 SUSE bug 1202941 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. Important CVE-2022-29581 SUSE bug 1199665 SUSE bug 1199695 SUSE bug 1205313 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. Important CVE-2022-29582 SUSE bug 1198811 SUSE bug 1199750 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system. Important CVE-2022-2959 SUSE bug 1202681 SUSE bug 1202685 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-2961 SUSE bug 1202660 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. Important CVE-2022-2964 SUSE bug 1202686 SUSE bug 1203008 SUSE bug 1208044 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system. Moderate CVE-2022-2977 SUSE bug 1202672 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2022-2978 SUSE bug 1202700 SUSE bug 1204745 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. Low CVE-2022-2980 SUSE bug 1203155 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0260. Moderate CVE-2022-2982 SUSE bug 1203152 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well. Important CVE-2022-29824 SUSE bug 1199132 SUSE bug 1202878 SUSE bug 1204121 SUSE bug 1204131 SUSE bug 1205069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. Moderate CVE-2022-29869 SUSE bug 1198976 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Moderate CVE-2022-2989 SUSE bug 1202809 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Moderate CVE-2022-2990 SUSE bug 1202812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. Moderate CVE-2022-29900 SUSE bug 1199657 SUSE bug 1201469 SUSE bug 1207894 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. Moderate CVE-2022-29901 SUSE bug 1201469 SUSE bug 1207894 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private. Low CVE-2022-29968 SUSE bug 1199087 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL. Important CVE-2022-30115 SUSE bug 1199225 SUSE bug 1204386 SUSE bug 1206308 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0286. Low CVE-2022-3016 SUSE bug 1202862 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. Moderate CVE-2022-3028 SUSE bug 1202898 SUSE bug 1212296 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0322. Low CVE-2022-3037 SUSE bug 1202962 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. Important CVE-2022-30594 SUSE bug 1199505 SUSE bug 1199602 SUSE bug 1201549 SUSE bug 1204132 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error. Moderate CVE-2022-3061 SUSE bug 1202913 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. This flaw could allow a local user to crash the system. Low CVE-2022-3077 SUSE bug 1203040 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c. Low CVE-2022-3078 SUSE bug 1203041 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0360. Moderate CVE-2022-3099 SUSE bug 1203110 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 off-by-one in io_uring module. Important CVE-2022-3103 SUSE bug 1203801 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used. Moderate CVE-2022-31030 SUSE bug 1200145 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference. Moderate CVE-2022-3104 SUSE bug 1206396 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array(). Moderate CVE-2022-3105 SUSE bug 1206398 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc(). Moderate CVE-2022-3106 SUSE bug 1206397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference. Moderate CVE-2022-3107 SUSE bug 1206395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup(). Moderate CVE-2022-3108 SUSE bug 1206389 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger(). Moderate CVE-2022-3111 SUSE bug 1206394 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference. Moderate CVE-2022-3112 SUSE bug 1206399 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference. Moderate CVE-2022-3113 SUSE bug 1206390 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference. Moderate CVE-2022-3114 SUSE bug 1206391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference. Moderate CVE-2022-3115 SUSE bug 1206393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225. Moderate CVE-2022-31252 SUSE bug 1203018 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0389. Low CVE-2022-3134 SUSE bug 1203194 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. Moderate CVE-2022-31394 SUSE bug 1208551 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. Moderate CVE-2022-3153 SUSE bug 1203272 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service. Moderate CVE-2022-3165 SUSE bug 1203788 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. Important CVE-2022-31676 SUSE bug 1202657 SUSE bug 1202733 SUSE bug 1202834 SUSE bug 1202995 SUSE bug 1204044 SUSE bug 1205471 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect. Moderate CVE-2022-3169 SUSE bug 1203290 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system. Important CVE-2022-3170 SUSE bug 1203321 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above. Important CVE-2022-3171 SUSE bug 1204256 SUSE bug 1206544 SUSE bug 1206545 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31741 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659 Important CVE-2022-3176 SUSE bug 1203391 SUSE bug 1203511 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. Important CVE-2022-32149 SUSE bug 1204501 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. Moderate CVE-2022-32205 SUSE bug 1200734 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. Moderate CVE-2022-32206 SUSE bug 1200735 SUSE bug 1207992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended. Moderate CVE-2022-32207 SUSE bug 1200736 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. Moderate CVE-2022-32208 SUSE bug 1200737 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. Important CVE-2022-32221 SUSE bug 1204383 SUSE bug 1205287 SUSE bug 1205834 SUSE bug 1206236 SUSE bug 1208340 SUSE bug 1211233 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. Important CVE-2022-32250 SUSE bug 1200015 SUSE bug 1200268 SUSE bug 1200494 SUSE bug 1202992 SUSE bug 1202993 SUSE bug 1203002 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056. Moderate CVE-2022-32296 SUSE bug 1200288 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. Important CVE-2022-3234 SUSE bug 1203508 SUSE bug 1206240 SUSE bug 1208002 SUSE bug 1208308 SUSE bug 1208651 SUSE bug 1209329 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0490. Low CVE-2022-3235 SUSE bug 1203509 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-3238 SUSE bug 1204655 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2022-3239 SUSE bug 1203552 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0530. Moderate CVE-2022-3256 SUSE bug 1204117 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer). Moderate CVE-2022-32742 SUSE bug 1201496 SUSE bug 1202815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it. Moderate CVE-2022-32743 SUSE bug 1202803 SUSE bug 1209483 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover. Important CVE-2022-32744 SUSE bug 1201493 SUSE bug 1202815 SUSE bug 1209664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault. Moderate CVE-2022-32745 SUSE bug 1201492 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl. Moderate CVE-2022-32746 SUSE bug 1201490 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. Low CVE-2022-3278 SUSE bug 1203799 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. Moderate CVE-2022-3296 SUSE bug 1203796 SUSE bug 1205395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0579. Moderate CVE-2022-3297 SUSE bug 1203797 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. Important CVE-2022-32981 SUSE bug 1200470 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition Moderate CVE-2022-3303 SUSE bug 1203769 SUSE bug 1212304 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. Important CVE-2022-33068 SUSE bug 1200900 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. Moderate CVE-2022-33099 SUSE bug 1201146 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2022-33196 SUSE bug 1208276 SUSE bug 1209936 SUSE bug 1211490 SUSE bug 1211511 SUSE bug 1213820 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. Moderate CVE-2022-3324 SUSE bug 1203820 SUSE bug 1205395 SUSE bug 1206240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0). Moderate CVE-2022-3344 SUSE bug 1204652 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0614. Moderate CVE-2022-3352 SUSE bug 1203924 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5). Moderate CVE-2022-3358 SUSE bug 1204226 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-33740 SUSE bug 1200762 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-33741 SUSE bug 1200762 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-33742 SUSE bug 1200762 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed. Important CVE-2022-33743 SUSE bug 1200763 SUSE bug 1201629 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / value between old and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition, omitting flushes where such are necessary. Important CVE-2022-33745 SUSE bug 1201394 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing. Moderate CVE-2022-33746 SUSE bug 1203806 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings. Low CVE-2022-33747 SUSE bug 1203804 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU. Moderate CVE-2022-33748 SUSE bug 1203807 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2022-33972 SUSE bug 1208479 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function. Moderate CVE-2022-33981 SUSE bug 1200692 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-3424 SUSE bug 1204166 SUSE bug 1204167 SUSE bug 1208044 SUSE bug 1212309 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource. Important CVE-2022-34266 SUSE bug 1201723 SUSE bug 1208311 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media. Important CVE-2022-34301 SUSE bug 1202857 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media. Moderate CVE-2022-34302 SUSE bug 1202737 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media. Important CVE-2022-34303 SUSE bug 1202856 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability. Moderate CVE-2022-3435 SUSE bug 1204171 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack. Moderate CVE-2022-3437 SUSE bug 1204254 SUSE bug 1205667 SUSE bug 1208992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free. Moderate CVE-2022-34494 SUSE bug 1201158 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free. Moderate CVE-2022-34495 SUSE bug 1201159 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. Important CVE-2022-34526 SUSE bug 1202026 SUSE bug 1205073 SUSE bug 1205505 SUSE bug 1208338 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash. Moderate CVE-2022-3479 SUSE bug 1204272 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. Moderate CVE-2022-34903 SUSE bug 1201225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. Low CVE-2022-3491 SUSE bug 1206028 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c. Important CVE-2022-34918 SUSE bug 1201171 SUSE bug 1201177 SUSE bug 1201222 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. Critical CVE-2022-3515 SUSE bug 1204357 SUSE bug 1204806 SUSE bug 1205080 SUSE bug 1205592 SUSE bug 1205627 SUSE bug 1206244 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Important CVE-2022-3520 SUSE bug 1206071 SUSE bug 1208100 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability. Moderate CVE-2022-3521 SUSE bug 1204355 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability. Moderate CVE-2022-3524 SUSE bug 1204354 SUSE bug 1212320 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. Low CVE-2022-35252 SUSE bug 1202593 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024. Moderate CVE-2022-3526 SUSE bug 1204353 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service. Moderate CVE-2022-35260 SUSE bug 1204384 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2022-3528 SUSE bug 1204374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2022-3529 SUSE bug 1204373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2022-3531 SUSE bug 1204420 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2022-3532 SUSE bug 1204418 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031. Moderate CVE-2022-3533 SUSE bug 1204393 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032. Important CVE-2022-3534 SUSE bug 1204391 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2022-3535 SUSE bug 1204417 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability. Important CVE-2022-3541 SUSE bug 1204403 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time." Moderate CVE-2022-35414 SUSE bug 1201367 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-3542 SUSE bug 1204402 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043. Moderate CVE-2022-3543 SUSE bug 1204401 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211044. Moderate CVE-2022-3544 SUSE bug 1204404 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211045 was assigned to this vulnerability. Important CVE-2022-3545 SUSE bug 1204415 SUSE bug 1204424 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-3554 SUSE bug 1204422 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-3555 SUSE bug 1204425 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087. Important CVE-2022-3564 SUSE bug 1206073 SUSE bug 1206314 SUSE bug 1208030 SUSE bug 1208044 SUSE bug 1208085 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088. Important CVE-2022-3565 SUSE bug 1204431 SUSE bug 1204432 SUSE bug 1208044 SUSE bug 1212323 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this vulnerability. Moderate CVE-2022-3566 SUSE bug 1204405 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier assigned to this vulnerability. Moderate CVE-2022-3567 SUSE bug 1204414 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact Moderate CVE-2022-3570 SUSE bug 1205422 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. Moderate CVE-2022-35737 SUSE bug 1201783 SUSE bug 1203345 SUSE bug 1211963 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumption, leaking to out-of-bound write. Moderate CVE-2022-3577 SUSE bug 1204470 SUSE bug 1204486 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service. Moderate CVE-2022-3586 SUSE bug 1204439 SUSE bug 1204576 SUSE bug 1208044 SUSE bug 1209225 SUSE bug 1212294 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0789. Important CVE-2022-3591 SUSE bug 1206072 SUSE bug 1208100 SUSE bug 1208649 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem. Moderate CVE-2022-3592 SUSE bug 1204499 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2022-3593 SUSE bug 1204484 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363. Moderate CVE-2022-3594 SUSE bug 1204479 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211364. Moderate CVE-2022-3595 SUSE bug 1204476 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Moderate CVE-2022-3597 SUSE bug 1204641 SUSE bug 1206220 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b. Moderate CVE-2022-3598 SUSE bug 1204642 SUSE bug 1206220 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. Moderate CVE-2022-3599 SUSE bug 1204643 SUSE bug 1206220 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). Important CVE-2022-3602 SUSE bug 1204714 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability. Moderate CVE-2022-3606 SUSE bug 1204502 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly. Moderate CVE-2022-36109 SUSE bug 1205375 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges. Moderate CVE-2022-36123 SUSE bug 1202010 SUSE bug 1202583 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the identifier assigned to this vulnerability. Moderate CVE-2022-3619 SUSE bug 1204569 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920. Moderate CVE-2022-3621 SUSE bug 1204574 SUSE bug 1212295 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function rlb_arp_xmit of the file drivers/net/bonding/bond_alb.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211928. Low CVE-2022-3624 SUSE bug 1204639 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability. Moderate CVE-2022-3625 SUSE bug 1204637 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Moderate CVE-2022-3626 SUSE bug 1204644 SUSE bug 1206220 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Moderate CVE-2022-3627 SUSE bug 1204645 SUSE bug 1206220 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges. Moderate CVE-2022-3628 SUSE bug 1204868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-36280 SUSE bug 1203332 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this vulnerability. Low CVE-2022-3629 SUSE bug 1204635 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects some unknown processing of the file fs/fscache/cookie.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211931. Moderate CVE-2022-3630 SUSE bug 1204634 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932. Low CVE-2022-3633 SUSE bug 1204650 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability. Important CVE-2022-3635 SUSE bug 1204631 SUSE bug 1204636 SUSE bug 1208044 SUSE bug 1212289 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as critical, was found in Linux Kernel. This affects the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c of the component Ethernet Handler. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211935. Moderate CVE-2022-3636 SUSE bug 1204638 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944. Important CVE-2022-3640 SUSE bug 1204619 SUSE bug 1204624 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-36402 SUSE bug 1203517 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-3642 SUSE bug 1204626 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior. Moderate CVE-2022-3643 SUSE bug 1206113 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. Low CVE-2022-3646 SUSE bug 1204646 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992. Low CVE-2022-3649 SUSE bug 1204647 SUSE bug 1212318 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. Important CVE-2022-3650 SUSE bug 1204430 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. Moderate CVE-2022-36879 SUSE bug 1201948 SUSE bug 1212327 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. Important CVE-2022-36946 SUSE bug 1201940 SUSE bug 1201941 SUSE bug 1202312 SUSE bug 1202874 SUSE bug 1203208 SUSE bug 1204132 SUSE bug 1205313 SUSE bug 1212310 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324. Moderate CVE-2022-3705 SUSE bug 1204779 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system. Moderate CVE-2022-3707 SUSE bug 1204780 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). Important CVE-2022-37434 SUSE bug 1202175 SUSE bug 1203030 SUSE bug 1205074 SUSE bug 1205289 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. Important CVE-2022-37454 SUSE bug 1204577 SUSE bug 1204966 SUSE bug 1205836 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-37708 SUSE bug 1208466 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded. Moderate CVE-2022-3775 SUSE bug 1205182 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Important CVE-2022-3786 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root. Important CVE-2022-3787 SUSE bug 1209929 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability Important CVE-2022-37966 SUSE bug 1205385 SUSE bug 1208347 SUSE bug 1208433 SUSE bug 1209664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Windows Kerberos Elevation of Privilege Vulnerability Important CVE-2022-37967 SUSE bug 1205386 SUSE bug 1208347 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Netlogon RPC Elevation of Privilege Vulnerability Important CVE-2022-38023 SUSE bug 1206504 SUSE bug 1209664 SUSE bug 1213694 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2022-38090 SUSE bug 1208275 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-38096 SUSE bug 1203331 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. Moderate CVE-2022-3821 SUSE bug 1204968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service. Moderate CVE-2022-3854 SUSE bug 1205025 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. Important CVE-2022-39028 SUSE bug 1203759 SUSE bug 1204804 SUSE bug 1205079 SUSE bug 1205326 SUSE bug 1205569 SUSE bug 1205622 SUSE bug 1206246 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system. Moderate CVE-2022-3903 SUSE bug 1205220 SUSE bug 1212297 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap. Important CVE-2022-39046 SUSE bug 1203011 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately. We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 Important CVE-2022-3910 SUSE bug 1205670 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs. Moderate CVE-2022-39188 SUSE bug 1203107 SUSE bug 1203116 SUSE bug 1205313 SUSE bug 1209225 SUSE bug 1212326 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations. Moderate CVE-2022-39189 SUSE bug 1203066 SUSE bug 1203067 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain. Moderate CVE-2022-39190 SUSE bug 1203117 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1. Moderate CVE-2022-39377 SUSE bug 1205224 SUSE bug 1211507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability. Important CVE-2022-3970 SUSE bug 1205392 SUSE bug 1208311 SUSE bug 1208312 SUSE bug 1208338 SUSE bug 1208655 SUSE bug 1209328 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system. Moderate CVE-2022-3977 SUSE bug 1207048 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen. Important CVE-2022-39842 SUSE bug 1203124 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466. Important CVE-2022-3996 SUSE bug 1206374 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. Important CVE-2022-40303 SUSE bug 1204366 SUSE bug 1204807 SUSE bug 1205549 SUSE bug 1206241 SUSE bug 1206248 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. Important CVE-2022-40304 SUSE bug 1204367 SUSE bug 1205069 SUSE bug 1205549 SUSE bug 1206241 SUSE bug 1206248 SUSE bug 1208343 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62. A local user could use this flaw to crash the system or potentially cause a denial of service. Moderate CVE-2022-40476 SUSE bug 1203435 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Important CVE-2022-40674 SUSE bug 1203438 SUSE bug 1204099 SUSE bug 1204177 SUSE bug 1204509 SUSE bug 1205077 SUSE bug 1205285 SUSE bug 1205527 SUSE bug 1205598 SUSE bug 1208339 SUSE bug 1208753 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that "(appropriately) short exponents" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together. Important CVE-2022-40735 SUSE bug 1205476 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case. Moderate CVE-2022-40768 SUSE bug 1203514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. Moderate CVE-2022-40897 SUSE bug 1206667 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. Moderate CVE-2022-40899 SUSE bug 1206673 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges. Important CVE-2022-4095 SUSE bug 1205514 SUSE bug 1205594 SUSE bug 1208030 SUSE bug 1208085 SUSE bug 1212319 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-40982 SUSE bug 1206418 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. Important CVE-2022-41218 SUSE bug 1202960 SUSE bug 1203606 SUSE bug 1205313 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. Moderate CVE-2022-41222 SUSE bug 1203622 SUSE bug 1203624 SUSE bug 1209225 SUSE bug 1209476 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service. Moderate CVE-2022-4127 SUSE bug 1205703 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service. Moderate CVE-2022-4128 SUSE bug 1205704 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. Moderate CVE-2022-4129 SUSE bug 1205711 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system. Moderate CVE-2022-4139 SUSE bug 1205700 SUSE bug 1205815 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. Moderate CVE-2022-41409 SUSE bug 1213514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. Important CVE-2022-4141 SUSE bug 1205797 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition. Moderate CVE-2022-4144 SUSE bug 1205808 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. Important CVE-2022-41674 SUSE bug 1203770 SUSE bug 1203994 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host. Moderate CVE-2022-4172 SUSE bug 1205847 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2022-41804 SUSE bug 1215580 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach. Moderate CVE-2022-41848 SUSE bug 1203987 SUSE bug 1211484 SUSE bug 1212317 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect. Moderate CVE-2022-41849 SUSE bug 1203992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress. Low CVE-2022-41850 SUSE bug 1203960 SUSE bug 1212314 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information. Moderate CVE-2022-41858 SUSE bug 1205671 SUSE bug 1211484 SUSE bug 1212300 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root. Important CVE-2022-41973 SUSE bug 1202739 SUSE bug 1209929 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR. Important CVE-2022-41974 SUSE bug 1205472 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. Low CVE-2022-42010 SUSE bug 1204111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. Moderate CVE-2022-42011 SUSE bug 1204112 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. Moderate CVE-2022-42012 SUSE bug 1204113 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Moderate CVE-2022-4203 SUSE bug 1207535 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain. Important CVE-2022-42309 SUSE bug 1204485 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base. Moderate CVE-2022-42310 SUSE bug 1204487 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42311 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42312 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42313 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42314 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42315 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42316 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42317 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42318 SUSE bug 1204482 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only after the request has been finished completely. A request is regarded to be finished only after the guest has read the response message of the request from the ring page. Thus a guest not reading the response can cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of Service (DoS) of xenstored. Moderate CVE-2022-42319 SUSE bug 1204488 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the domid of the removed domain. This is normally no problem, as those access right entries will be corrected when such a node is written later. There is a small time window when a new domain is created, where the access rights of a past domain with the same domid as the new one will be regarded to be still valid, leading to the new domain being able to get access to a node which was meant to be accessible by the removed domain. For this to happen another domain needs to write the node before the newly created domain is being introduced to Xenstore by dom0. Important CVE-2022-42320 SUSE bug 1204489 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. Moderate CVE-2022-42321 SUSE bug 1204490 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by Xenstore quota. Moderate CVE-2022-42322 SUSE bug 1204494 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by Xenstore quota. Moderate CVE-2022-42323 SUSE bug 1204494 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes. Moderate CVE-2022-42325 SUSE bug 1204496 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes. Moderate CVE-2022-42326 SUSE bug 1204496 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests. Low CVE-2022-42327 SUSE bug 1204483 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329). Moderate CVE-2022-42328 SUSE bug 1206114 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329). Moderate CVE-2022-42329 SUSE bug 1206114 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same impact. Moderate CVE-2022-42330 SUSE bug 1207544 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks. Moderate CVE-2022-42331 SUSE bug 1209019 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to keep error handling efforts within reasonable bounds, for operations which may require memory allocations shadow mode logic ensures up front that enough memory is available for the worst case requirements. Unfortunately, while page table memory is properly accounted for on the code path requiring the potential establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As a result, just established shadow page tables could be freed again immediately, while other code is still accessing them on the assumption that they would remain allocated. Important CVE-2022-42332 SUSE bug 1209017 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334). Moderate CVE-2022-42333 SUSE bug 1209018 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334). Moderate CVE-2022-42334 SUSE bug 1209018 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control. Important CVE-2022-42335 SUSE bug 1210315 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is coordinated at a core level, as the setting is shared between threads. Logic was introduced to keep track of how many threads require SSBD active in order to coordinate it, such logic relies on using a per-core counter of threads that have SSBD active. When running on the mentioned hardware, it's possible for a guest to under or overflow the thread counter, because each write to VIRT_SPEC_CTRL.SSBD by the guest gets propagated to the helper that does the per-core active accounting. Underflowing the counter causes the value to get saturated, and thus attempts for guests running on the same core to set SSBD won't have effect because the hypervisor assumes it's already active. Low CVE-2022-42336 SUSE bug 1211433 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters Important CVE-2022-4254 SUSE bug 1207474 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. Moderate CVE-2022-4269 SUSE bug 1206024 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse. Important CVE-2022-42703 SUSE bug 1204168 SUSE bug 1204170 SUSE bug 1206463 SUSE bug 1208044 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code. Important CVE-2022-42719 SUSE bug 1204051 SUSE bug 1204292 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code. Important CVE-2022-42720 SUSE bug 1204059 SUSE bug 1204291 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code. Important CVE-2022-42721 SUSE bug 1204060 SUSE bug 1204290 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. Important CVE-2022-42722 SUSE bug 1204125 SUSE bug 1204289 SUSE bug 1209225 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url Moderate CVE-2022-42895 SUSE bug 1205705 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url Moderate CVE-2022-42896 SUSE bug 1205709 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug." Moderate CVE-2022-42898 SUSE bug 1205126 SUSE bug 1205667 SUSE bug 1207423 SUSE bug 1207690 SUSE bug 1211487 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0. Important CVE-2022-42915 SUSE bug 1204385 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26. Important CVE-2022-42916 SUSE bug 1204386 SUSE bug 1206308 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9. Important CVE-2022-42919 SUSE bug 1204886 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0882. Important CVE-2022-4292 SUSE bug 1206075 SUSE bug 1208100 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. Moderate CVE-2022-4293 SUSE bug 1206077 SUSE bug 1211489 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Moderate CVE-2022-42969 SUSE bug 1204364 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. Moderate CVE-2022-4304 SUSE bug 1207534 SUSE bug 1210067 SUSE bug 1213146 SUSE bug 1213289 SUSE bug 1215014 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded. Important CVE-2022-43551 SUSE bug 1206308 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. Moderate CVE-2022-43552 SUSE bug 1206309 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. Important CVE-2022-43680 SUSE bug 1204708 SUSE bug 1205590 SUSE bug 1205598 SUSE bug 1208339 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. Moderate CVE-2022-43750 SUSE bug 1204653 SUSE bug 1211484 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-4378 SUSE bug 1206207 SUSE bug 1206228 SUSE bug 1208030 SUSE bug 1208085 SUSE bug 1209225 SUSE bug 1211118 SUSE bug 1214268 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial Important CVE-2022-4379 SUSE bug 1206209 SUSE bug 1206373 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side. Important CVE-2022-4382 SUSE bug 1206258 SUSE bug 1206363 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Important CVE-2022-43945 SUSE bug 1205128 SUSE bug 1205130 SUSE bug 1208030 SUSE bug 1208085 SUSE bug 1209225 SUSE bug 1210124 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture. Important CVE-2022-43995 SUSE bug 1204986 SUSE bug 1205838 SUSE bug 1205969 SUSE bug 1206905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cmm_open() and cm4000_detach(). Moderate CVE-2022-44032 SUSE bug 1204894 SUSE bug 1212290 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach(). Moderate CVE-2022-44033 SUSE bug 1204922 SUSE bug 1212306 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between scr24x_open() and scr24x_remove(). Moderate CVE-2022-44034 SUSE bug 1204901 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting. Moderate CVE-2022-4415 SUSE bug 1205000 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. Moderate CVE-2022-4450 SUSE bug 1207538 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y. Important CVE-2022-44638 SUSE bug 1205033 SUSE bug 1208313 SUSE bug 1208345 SUSE bug 1211497 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. Moderate CVE-2022-45061 SUSE bug 1205244 SUSE bug 1211488 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96). Important CVE-2022-45141 SUSE bug 1206517 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted. Important CVE-2022-45142 SUSE bug 1208992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions. Moderate CVE-2022-45154 SUSE bug 1207598 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled. Moderate CVE-2022-45869 SUSE bug 1205882 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file. Moderate CVE-2022-45873 SUSE bug 1205713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. Moderate CVE-2022-45884 SUSE bug 1205756 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a device is disconnected. Moderate CVE-2022-45885 SUSE bug 1205758 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. Moderate CVE-2022-45886 SUSE bug 1205760 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. Moderate CVE-2022-45887 SUSE bug 1205762 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device. Low CVE-2022-45888 SUSE bug 1205764 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. Important CVE-2022-45919 SUSE bug 1205803 SUSE bug 1208912 SUSE bug 1214128 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets. Moderate CVE-2022-45934 SUSE bug 1205796 SUSE bug 1212292 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system. Moderate CVE-2022-4662 SUSE bug 1206664 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. Moderate CVE-2022-46663 SUSE bug 1207815 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU memory processing operations to access a limited amount outside of buffer bounds. This affects Valhall r29p0 through r41p0 before r42p0 and Avalon r41p0 before r42p0. Low CVE-2022-46781 SUSE bug 1210235 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. Important CVE-2022-46908 SUSE bug 1206337 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above Important CVE-2022-4696 SUSE bug 1207118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts. Low CVE-2022-47024 SUSE bug 1207397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-4744 SUSE bug 1209635 SUSE bug 1209672 SUSE bug 1211833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames. Moderate CVE-2022-47518 SUSE bug 1206511 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames. Important CVE-2022-47519 SUSE bug 1206512 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. Important CVE-2022-47520 SUSE bug 1206515 SUSE bug 1207823 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames. Moderate CVE-2022-47521 SUSE bug 1206516 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. Important CVE-2022-47629 SUSE bug 1206579 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c. Moderate CVE-2022-47929 SUSE bug 1207237 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT. Moderate CVE-2022-47938 SUSE bug 1206658 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT. Critical CVE-2022-47939 SUSE bug 1206654 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write. Critical CVE-2022-47940 SUSE bug 1206679 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak. Moderate CVE-2022-47941 SUSE bug 1206656 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command. Important CVE-2022-47942 SUSE bug 1206657 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case. Critical CVE-2022-47943 SUSE bug 1206655 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq. Moderate CVE-2022-47946 SUSE bug 1206714 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. Important CVE-2022-48281 SUSE bug 1207413 SUSE bug 1208655 SUSE bug 1209328 SUSE bug 1209937 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Moderate CVE-2022-48303 SUSE bug 1207753 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system. Moderate CVE-2022-4842 SUSE bug 1206749 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur. Moderate CVE-2022-48423 SUSE bug 1209479 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur. Moderate CVE-2022-48424 SUSE bug 1209475 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. Moderate CVE-2022-48425 SUSE bug 1209501 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. Moderate CVE-2022-48502 SUSE bug 1211887 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. Critical CVE-2022-48522 SUSE bug 1214583 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project. Moderate CVE-2022-48554 SUSE bug 1214507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free exists in Python through 3.9 via heappushpop in heapq. Moderate CVE-2022-48560 SUSE bug 1214675 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. Moderate CVE-2022-48564 SUSE bug 1214677 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. Moderate CVE-2022-48565 SUSE bug 1214685 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. Moderate CVE-2022-48566 SUSE bug 1214691 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. Moderate CVE-2022-4899 SUSE bug 1209533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. Moderate CVE-2022-4904 SUSE bug 1208067 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2023-0030 SUSE bug 1206777 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set ?function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. ?The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit?a664ec9158eeddd75121d39c9a0758016097fa96 Moderate CVE-2023-0045 SUSE bug 1207773 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. Moderate CVE-2023-0049 SUSE bug 1206866 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. Moderate CVE-2023-0051 SUSE bug 1206867 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. Moderate CVE-2023-0054 SUSE bug 1206868 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4. Moderate CVE-2023-0122 SUSE bug 1207050 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. Important CVE-2023-0179 SUSE bug 1207034 SUSE bug 1207139 SUSE bug 1215208 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems. Important CVE-2023-0210 SUSE bug 1206707 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. Moderate CVE-2023-0215 SUSE bug 1207536 SUSE bug 1213146 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data. Moderate CVE-2023-0216 SUSE bug 1207539 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3. Important CVE-2023-0217 SUSE bug 1207540 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory. Moderate CVE-2023-0225 SUSE bug 1209483 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel.?SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit?56b88b50565cd8b946a2d00b0c83927b7ebb055e Important CVE-2023-0266 SUSE bug 1207134 SUSE bug 1207190 SUSE bug 1214128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. Important CVE-2023-0286 SUSE bug 1207533 SUSE bug 1207569 SUSE bug 1211136 SUSE bug 1211503 SUSE bug 1213146 SUSE bug 1214269 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. Moderate CVE-2023-0288 SUSE bug 1207162 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free. Moderate CVE-2023-0330 SUSE bug 1207205 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection. Moderate CVE-2023-0361 SUSE bug 1208143 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. Important CVE-2023-0386 SUSE bug 1209615 SUSE bug 1210499 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. Moderate CVE-2023-0394 SUSE bug 1207168 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data. Important CVE-2023-0401 SUSE bug 1207541 SUSE bug 1210509 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. Low CVE-2023-0433 SUSE bug 1207396 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit?739790605705ddcf18f21782b9c99ad7d53a8c11 Moderate CVE-2023-0458 SUSE bug 1210905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit?74e19ef0ff8061ef55957c3abd71614ef0f42f47 Moderate CVE-2023-0459 SUSE bug 1211738 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS?or CONFIG_XFRM_ESPINTCP?has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data?of a struct inet_connection_sock. When CONFIG_TLS?is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt?TCP_ULP?operation does not require any privilege. We recommend upgrading past commit?2c02d41d71f90a5168391b6a5f2954112ba2307c Important CVE-2023-0461 SUSE bug 1208787 SUSE bug 1208911 SUSE bug 1211833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Moderate CVE-2023-0464 SUSE bug 1209624 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Moderate CVE-2023-0465 SUSE bug 1209878 SUSE bug 1212331 SUSE bug 1215014 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. Moderate CVE-2023-0466 SUSE bug 1209873 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference. Moderate CVE-2023-0468 SUSE bug 1207511 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service. Moderate CVE-2023-0469 SUSE bug 1207521 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. Important CVE-2023-0512 SUSE bug 1207780 SUSE bug 1210385 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected. Important CVE-2023-0590 SUSE bug 1207795 SUSE bug 1207822 SUSE bug 1211495 SUSE bug 1211833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory. Moderate CVE-2023-0597 SUSE bug 1207845 SUSE bug 1212395 SUSE bug 1213271 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. Moderate CVE-2023-0614 SUSE bug 1209485 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled. Moderate CVE-2023-0615 SUSE bug 1207844 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Important CVE-2023-0634 SUSE bug 1207857 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system. Important CVE-2023-0664 SUSE bug 1208531 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. Low CVE-2023-0687 SUSE bug 1207975 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Important CVE-2023-0767 SUSE bug 1208138 SUSE bug 1213200 SUSE bug 1213818 SUSE bug 1214271 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system. Moderate CVE-2023-0778 SUSE bug 1208364 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0795 SUSE bug 1208226 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0796 SUSE bug 1208227 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0797 SUSE bug 1208228 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0798 SUSE bug 1208229 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0799 SUSE bug 1208230 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0800 SUSE bug 1208231 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0801 SUSE bug 1208232 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0802 SUSE bug 1208233 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0803 SUSE bug 1208234 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0804 SUSE bug 1208236 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. Moderate CVE-2023-0922 SUSE bug 1209481 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. Important CVE-2023-1017 SUSE bug 1206022 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM. Low CVE-2023-1018 SUSE bug 1206023 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-1032 SUSE bug 1209240 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready. Low CVE-2023-1075 SUSE bug 1208598 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters. Moderate CVE-2023-1076 SUSE bug 1208599 SUSE bug 1214019 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption. Important CVE-2023-1077 SUSE bug 1208600 SUSE bug 1208839 SUSE bug 1213841 SUSE bug 1213842 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption. Important CVE-2023-1078 SUSE bug 1208601 SUSE bug 1208603 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data. Moderate CVE-2023-1079 SUSE bug 1208604 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. Moderate CVE-2023-1095 SUSE bug 1208777 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2023-1118 SUSE bug 1208837 SUSE bug 1208910 SUSE bug 1210423 SUSE bug 1211495 SUSE bug 1213841 SUSE bug 1213842 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. Moderate CVE-2023-1127 SUSE bug 1208828 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. Moderate CVE-2023-1170 SUSE bug 1208959 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. Moderate CVE-2023-1175 SUSE bug 1208957 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-1192 SUSE bug 1208995 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-1193 SUSE bug 1208972 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-1194 SUSE bug 1208968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server->hostname to NULL, leading to an invalid pointer request. Low CVE-2023-1195 SUSE bug 1208971 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%. Moderate CVE-2023-1206 SUSE bug 1212703 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. Moderate CVE-2023-1249 SUSE bug 1209039 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected. Moderate CVE-2023-1252 SUSE bug 1209045 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service. If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one. Moderate CVE-2023-1255 SUSE bug 1210714 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. Moderate CVE-2023-1264 SUSE bug 1209042 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation.?The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.?A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. Important CVE-2023-1281 SUSE bug 1209634 SUSE bug 1209683 SUSE bug 1210335 SUSE bug 1210423 SUSE bug 1211833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93. Important CVE-2023-1295 SUSE bug 1212836 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. Moderate CVE-2023-1355 SUSE bug 1209187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. Low CVE-2023-1380 SUSE bug 1209287 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Moderate CVE-2023-1382 SUSE bug 1209288 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition. Important CVE-2023-1390 SUSE bug 1209289 SUSE bug 1210779 SUSE bug 1211495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-1476 SUSE bug 1209476 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. Low CVE-2023-1513 SUSE bug 1209532 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service. Moderate CVE-2023-1582 SUSE bug 1209636 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash. Moderate CVE-2023-1583 SUSE bug 1209637 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Important CVE-2023-1601 SUSE bug 1211582 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea Moderate CVE-2023-1611 SUSE bug 1209687 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks. Moderate CVE-2023-1637 SUSE bug 1209779 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem. Moderate CVE-2023-1652 SUSE bug 1209788 SUSE bug 1209797 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2023-1670 SUSE bug 1209871 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem. Moderate CVE-2023-1838 SUSE bug 1210203 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem. Moderate CVE-2023-1855 SUSE bug 1210202 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak. Low CVE-2023-1859 SUSE bug 1210169 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8. Important CVE-2023-1872 SUSE bug 1210414 SUSE bug 1210417 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. Moderate CVE-2023-1981 SUSE bug 1210328 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. Important CVE-2023-1989 SUSE bug 1210336 SUSE bug 1210500 SUSE bug 1213841 SUSE bug 1213842 SUSE bug 1214128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem. Moderate CVE-2023-1990 SUSE bug 1210337 SUSE bug 1210501 SUSE bug 1214128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. Moderate CVE-2023-1998 SUSE bug 1210506 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. Moderate CVE-2023-2002 SUSE bug 1210533 SUSE bug 1210566 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2023-2004 SUSE bug 1210419 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel. Important CVE-2023-2006 SUSE bug 1210447 SUSE bug 1210457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. Moderate CVE-2023-2007 SUSE bug 1210448 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Moderate CVE-2023-2008 SUSE bug 1210453 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system. Moderate CVE-2023-2019 SUSE bug 1210454 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. Moderate CVE-2023-20569 SUSE bug 1213287 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.? Moderate CVE-2023-20588 SUSE bug 1213927 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. Moderate CVE-2023-20593 SUSE bug 1213286 SUSE bug 1213616 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Low CVE-2023-20867 SUSE bug 1212143 SUSE bug 1214402 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. Moderate CVE-2023-20897 SUSE bug 1214796 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. Moderate CVE-2023-20898 SUSE bug 1214797 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html ?in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . Important CVE-2023-20900 SUSE bug 1214566 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264029575References: Upstream kernel Moderate CVE-2023-20941 SUSE bug 1210676 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-260821414References: Upstream kernel Important CVE-2023-21102 SUSE bug 1212155 SUSE bug 1212346 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-265016072References: Upstream kernel Important CVE-2023-21106 SUSE bug 1211654 SUSE bug 1211655 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2023-2124 SUSE bug 1210498 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check in the wrong place. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Moderate CVE-2023-21264 SUSE bug 1214289 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation. Moderate CVE-2023-21400 SUSE bug 1213272 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. Important CVE-2023-2156 SUSE bug 1211131 SUSE bug 1211395 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Moderate CVE-2023-2162 SUSE bug 1210647 SUSE bug 1210662 SUSE bug 1213841 SUSE bug 1213842 SUSE bug 1214128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory Corruption due to improper validation of array index in Linux while updating adn record. Moderate CVE-2023-21636 SUSE bug 1215069 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service. Moderate CVE-2023-2166 SUSE bug 1210627 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege. Important CVE-2023-2176 SUSE bug 1210629 SUSE bug 1210630 SUSE bug 1213842 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service. Moderate CVE-2023-2177 SUSE bug 1210643 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. Moderate CVE-2023-2194 SUSE bug 1210715 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant. A malicious local user with CAP_NET_ADMIN can use this to crash the kernel. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2023-22024 SUSE bug 1215615 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but?remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2. Important CVE-2023-2235 SUSE bug 1210986 SUSE bug 1210987 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both?io_install_fixed_file?and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4. Important CVE-2023-2236 SUSE bug 1210990 SUSE bug 1210991 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Important CVE-2023-2251 SUSE bug 1210801 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2. Important CVE-2023-22652 SUSE bug 1211078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. Important CVE-2023-22809 SUSE bug 1207082 SUSE bug 1208053 SUSE bug 1209326 SUSE bug 1214446 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK. Moderate CVE-2023-2283 SUSE bug 1211190 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. Low CVE-2023-22995 SUSE bug 1208741 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device. Moderate CVE-2023-22996 SUSE bug 1208781 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Low CVE-2023-22997 SUSE bug 1208782 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-22998 SUSE bug 1208776 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-22999 SUSE bug 1208785 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used. Low CVE-2023-23000 SUSE bug 1208816 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Low CVE-2023-23001 SUSE bug 1208829 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-23002 SUSE bug 1208840 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value. Low CVE-2023-23003 SUSE bug 1208842 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Low CVE-2023-23004 SUSE bug 1208843 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached. Low CVE-2023-23005 SUSE bug 1208844 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-23006 SUSE bug 1208845 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove(). Moderate CVE-2023-23039 SUSE bug 1208641 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Important CVE-2023-23454 SUSE bug 1207036 SUSE bug 1207188 SUSE bug 1208030 SUSE bug 1208044 SUSE bug 1208085 SUSE bug 1211833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Important CVE-2023-23455 SUSE bug 1207125 SUSE bug 1207189 SUSE bug 1211833 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. Moderate CVE-2023-23559 SUSE bug 1207051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring Moderate CVE-2023-23586 SUSE bug 1208474 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access. Important CVE-2023-23908 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on. Important CVE-2023-23914 SUSE bug 1207990 SUSE bug 1207991 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS. Important CVE-2023-23915 SUSE bug 1207991 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors. Moderate CVE-2023-23916 SUSE bug 1207992 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. Low CVE-2023-23931 SUSE bug 1208036 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. Moderate CVE-2023-2426 SUSE bug 1210996 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat. Moderate CVE-2023-2430 SUSE bug 1211014 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Important CVE-2023-24329 SUSE bug 1208471 SUSE bug 1213553 SUSE bug 1213554 SUSE bug 1213839 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** Rejected by upstream. Moderate CVE-2023-24593 SUSE bug 1209714 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2023-2483 SUSE bug 1211037 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. Moderate CVE-2023-25012 SUSE bug 1207560 SUSE bug 1207846 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors. Moderate CVE-2023-2513 SUSE bug 1211105 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes. Important CVE-2023-25139 SUSE bug 1208189 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. Moderate CVE-2023-25153 SUSE bug 1208423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups. Moderate CVE-2023-25173 SUSE bug 1208426 SUSE bug 1215588 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** Rejected by upstream. Moderate CVE-2023-25180 SUSE bug 1209713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. Important CVE-2023-25193 SUSE bug 1207922 SUSE bug 1213939 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215. Important CVE-2023-25434 SUSE bug 1212397 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753. Moderate CVE-2023-25435 SUSE bug 1212607 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. Low CVE-2023-25809 SUSE bug 1209884 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-2593 SUSE bug 1211527 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation. Important CVE-2023-2598 SUSE bug 1211046 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. Low CVE-2023-2602 SUSE bug 1211418 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. Moderate CVE-2023-2603 SUSE bug 1211419 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata. Moderate CVE-2023-26083 SUSE bug 1210236 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. Important CVE-2023-2609 SUSE bug 1211256 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Important CVE-2023-2610 SUSE bug 1211257 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. Moderate CVE-2023-26116 SUSE bug 1209939 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock). Moderate CVE-2023-2612 SUSE bug 1211902 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow. Important CVE-2023-26242 SUSE bug 1208518 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. Moderate CVE-2023-2650 SUSE bug 1211430 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. Moderate CVE-2023-26544 SUSE bug 1208697 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. Moderate CVE-2023-26545 SUSE bug 1208700 SUSE bug 1208909 SUSE bug 1210423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid. Important CVE-2023-26605 SUSE bug 1208699 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c. Moderate CVE-2023-26606 SUSE bug 1208694 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c. Important CVE-2023-26607 SUSE bug 1208703 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750. Important CVE-2023-2680 SUSE bug 1211403 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup. Moderate CVE-2023-2700 SUSE bug 1211390 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Sudo before 1.9.13p2 has a double free in the per-command chroot feature. Moderate CVE-2023-27320 SUSE bug 1208595 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. Moderate CVE-2023-27371 SUSE bug 1208745 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system. Moderate CVE-2023-27533 SUSE bug 1209209 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. Moderate CVE-2023-27534 SUSE bug 1209210 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information. Moderate CVE-2023-27535 SUSE bug 1209211 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. Moderate CVE-2023-27536 SUSE bug 1209212 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free. Moderate CVE-2023-27537 SUSE bug 1209213 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection. Moderate CVE-2023-27538 SUSE bug 1209214 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. Moderate CVE-2023-27561 SUSE bug 1208962 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash. Moderate CVE-2023-2804 SUSE bug 1211542 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. Important CVE-2023-28154 SUSE bug 1209486 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed. Moderate CVE-2023-28319 SUSE bug 1211230 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave. Low CVE-2023-28320 SUSE bug 1211231 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`. Moderate CVE-2023-28321 SUSE bug 1211232 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST. Important CVE-2023-28322 SUSE bug 1211233 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. Moderate CVE-2023-28327 SUSE bug 1209290 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. Moderate CVE-2023-28328 SUSE bug 1209291 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. Low CVE-2023-28370 SUSE bug 1211741 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable escalation of privilege via local access. Important CVE-2023-28410 SUSE bug 1211263 SUSE bug 1211819 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. Moderate CVE-2023-28450 SUSE bug 1209358 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation. Important CVE-2023-28464 SUSE bug 1209052 SUSE bug 1211111 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). Important CVE-2023-28466 SUSE bug 1209366 SUSE bug 1210452 SUSE bug 1211833 SUSE bug 1213841 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. Moderate CVE-2023-28484 SUSE bug 1210411 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Sudo before 1.9.13 does not escape control characters in log messages. Moderate CVE-2023-28486 SUSE bug 1209362 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Sudo before 1.9.13 does not escape control characters in sudoreplay output. Moderate CVE-2023-28487 SUSE bug 1209361 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. Critical CVE-2023-28531 SUSE bug 1209420 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. Moderate CVE-2023-28642 SUSE bug 1209888 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access. Moderate CVE-2023-28736 SUSE bug 1214244 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. Important CVE-2023-28772 SUSE bug 1209549 SUSE bug 1211110 SUSE bug 1214378 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. Two iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded. The injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container’s outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network. Patches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. Important CVE-2023-28840 SUSE bug 1214107 SUSE bug 1215525 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. An iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation. Encrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees. It is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. Moderate CVE-2023-28841 SUSE bug 1214108 SUSE bug 1215525 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. The `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate. Encrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. In multi-node clusters, deploy a global ‘pause’ container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec. Moderate CVE-2023-28842 SUSE bug 1214109 SUSE bug 1215525 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not. Moderate CVE-2023-28866 SUSE bug 1209780 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access. Low CVE-2023-28938 SUSE bug 1214245 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem. Moderate CVE-2023-2898 SUSE bug 1211742 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. Moderate CVE-2023-29383 SUSE bug 1210507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero. Moderate CVE-2023-29407 SUSE bug 1213967 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU. Low CVE-2023-29408 SUSE bug 1213928 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). Moderate CVE-2023-29469 SUSE bug 1210412 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable. Moderate CVE-2023-29491 SUSE bug 1210434 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. Moderate CVE-2023-2953 SUSE bug 1211795 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue. Moderate CVE-2023-2975 SUSE bug 1213383 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible. Moderate CVE-2023-2977 SUSE bug 1211894 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. Moderate CVE-2023-2985 SUSE bug 1211867 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack overflow vulnerability exists in function econf_writeFile in file atlibeconf/lib/libeconf.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code. Important CVE-2023-30078 SUSE bug 1214597 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A stack overflow vulnerability exists in function read_file in atlibeconf/lib/getfilecontents.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code. Important CVE-2023-30079 SUSE bug 1214598 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Important CVE-2023-3019 SUSE bug 1213269 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress. Moderate CVE-2023-3022 SUSE bug 1211906 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. Moderate CVE-2023-30630 SUSE bug 1210418 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device. Moderate CVE-2023-30772 SUSE bug 1210329 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values. Moderate CVE-2023-30774 SUSE bug 1210493 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if?CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. Important CVE-2023-3090 SUSE bug 1212842 SUSE bug 1212849 SUSE bug 1214128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely. Moderate CVE-2023-3106 SUSE bug 1213251 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_bridge.c in the Linux kernel 6.2. There is a NULL pointer dereference in vidtv_mux_stop_thread. In vidtv_stop_streaming, after dvb->mux=NULL occurs, it executes vidtv_mux_stop_thread(dvb->mux). Moderate CVE-2023-31081 SUSE bug 1210782 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process. Moderate CVE-2023-31084 SUSE bug 1210783 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1. Low CVE-2023-31124 SUSE bug 1211607 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. Moderate CVE-2023-31130 SUSE bug 1211606 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. Moderate CVE-2023-31147 SUSE bug 1211605 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** Duplicate of CVE-2023-3390. Important CVE-2023-3117 SUSE bug 1212934 SUSE bug 1213245 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace Important CVE-2023-31248 SUSE bug 1213061 SUSE bug 1213064 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption. Important CVE-2023-3138 SUSE bug 1212102 SUSE bug 1212746 SUSE bug 1213994 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. Moderate CVE-2023-3141 SUSE bug 1212129 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. Moderate CVE-2023-31436 SUSE bug 1210940 SUSE bug 1211260 SUSE bug 1213841 SUSE bug 1213842 SUSE bug 1214128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Important CVE-2023-31484 SUSE bug 1210999 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails. Important CVE-2023-3159 SUSE bug 1212128 SUSE bug 1212347 SUSE bug 1213842 SUSE bug 1214128 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service. Moderate CVE-2023-3161 SUSE bug 1212154 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. Important CVE-2023-3180 SUSE bug 1213925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for. Moderate CVE-2023-32001 SUSE bug 1213237 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1. Important CVE-2023-32067 SUSE bug 1211604 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic. Moderate CVE-2023-3212 SUSE bug 1212265 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2. Important CVE-2023-32181 SUSE bug 1211078 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference. Moderate CVE-2023-3220 SUSE bug 1212556 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. Important CVE-2023-32233 SUSE bug 1211043 SUSE bug 1211187 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-32246 SUSE bug 1211528 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Important CVE-2023-32247 SUSE bug 1211529 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Important CVE-2023-32248 SUSE bug 1211530 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-32249 SUSE bug 1211531 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Important CVE-2023-32250 SUSE bug 1211532 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2023-32251 SUSE bug 1211533 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Important CVE-2023-32252 SUSE bug 1211534 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-32253 SUSE bug 1211535 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Critical CVE-2023-32254 SUSE bug 1211536 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-32255 SUSE bug 1211537 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-32256 SUSE bug 1211538 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Important CVE-2023-32257 SUSE bug 1211539 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Important CVE-2023-32258 SUSE bug 1211540 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. Moderate CVE-2023-32269 SUSE bug 1211186 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of publication. Moderate CVE-2023-32324 SUSE bug 1211643 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents. Moderate CVE-2023-32360 SUSE bug 1214254 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. Moderate CVE-2023-3255 SUSE bug 1213001 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels Important CVE-2023-32629 SUSE bug 1213685 SUSE bug 1213707 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665. Important CVE-2023-32643 SUSE bug 1211946 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. Moderate CVE-2023-3268 SUSE bug 1212502 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0. Moderate CVE-2023-32681 SUSE bug 1211674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges. Important CVE-2023-3269 SUSE bug 1212395 SUSE bug 1213760 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service. Moderate CVE-2023-3301 SUSE bug 1213414 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, during device unbind will lead to double release problem leading to denial of service. Moderate CVE-2023-3312 SUSE bug 1212536 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. Moderate CVE-2023-33204 SUSE bug 1211507 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c. Moderate CVE-2023-33250 SUSE bug 1211597 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system. Important CVE-2023-3326 SUSE bug 1212615 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition. Moderate CVE-2023-33288 SUSE bug 1211590 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. Moderate CVE-2023-33460 SUSE bug 1212928 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data. Moderate CVE-2023-3347 SUSE bug 1213170 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service. Important CVE-2023-3354 SUSE bug 1212850 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system. Low CVE-2023-3355 SUSE bug 1212778 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system. Moderate CVE-2023-3357 SUSE bug 1212605 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system. Moderate CVE-2023-3358 SUSE bug 1212606 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference. Moderate CVE-2023-3359 SUSE bug 1212608 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c. Moderate CVE-2023-33595 SUSE bug 1212127 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and?0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable). Moderate CVE-2023-3389 SUSE bug 1212838 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit?1240eb93f0616b21c675416516ff3d74798fdc97. Important CVE-2023-3390 SUSE bug 1212846 SUSE bug 1212934 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel. Moderate CVE-2023-33951 SUSE bug 1211593 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A double-free vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of vmw_buffer_object objects. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. This flaw allows a local privileged user to escalate privileges and execute code in the context of the kernel. Important CVE-2023-33952 SUSE bug 1211595 SUSE bug 1212348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue. Important CVE-2023-34241 SUSE bug 1212230 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access. Low CVE-2023-34256 SUSE bug 1211895 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver. Moderate CVE-2023-34319 SUSE bug 1213546 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-34322 SUSE bug 1215145 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service. Moderate CVE-2023-3439 SUSE bug 1212845 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Moderate CVE-2023-3446 SUSE bug 1213487 SUSE bug 1213853 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. Important CVE-2023-34966 SUSE bug 1213173 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves. Moderate CVE-2023-34967 SUSE bug 1213172 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path. Moderate CVE-2023-34968 SUSE bug 1213171 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6. Moderate CVE-2023-34969 SUSE bug 1212126 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace Important CVE-2023-35001 SUSE bug 1213059 SUSE bug 1213063 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information. Important CVE-2023-3567 SUSE bug 1213167 SUSE bug 1213244 SUSE bug 1213842 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. Important CVE-2023-35788 SUSE bug 1212504 SUSE bug 1212509 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. Moderate CVE-2023-35823 SUSE bug 1212494 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c. Moderate CVE-2023-35824 SUSE bug 1212501 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in cedrus_remove in drivers/staging/media/sunxi/cedrus/cedrus.c. Moderate CVE-2023-35826 SUSE bug 1212505 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c. Moderate CVE-2023-35827 SUSE bug 1212514 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. Moderate CVE-2023-35828 SUSE bug 1212513 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c. Moderate CVE-2023-35829 SUSE bug 1212495 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11. Important CVE-2023-35945 SUSE bug 1215713 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. Important CVE-2023-36054 SUSE bug 1214054 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. Moderate CVE-2023-3609 SUSE bug 1213586 SUSE bug 1213587 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. Important CVE-2023-3610 SUSE bug 1213580 SUSE bug 1213584 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. Moderate CVE-2023-3611 SUSE bug 1213585 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption. Moderate CVE-2023-36660 SUSE bug 1212708 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-37327 SUSE bug 1213128 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-37328 SUSE bug 1213131 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c. Moderate CVE-2023-37453 SUSE bug 1213123 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon. Moderate CVE-2023-3750 SUSE bug 1213447 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. Moderate CVE-2023-3772 SUSE bug 1213666 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace. Moderate CVE-2023-3773 SUSE bug 1213667 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. Moderate CVE-2023-3776 SUSE bug 1213588 SUSE bug 1215119 SUSE bug 1215674 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. Important CVE-2023-37920 SUSE bug 1213662 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2023-3812 SUSE bug 1213543 SUSE bug 1213706 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Moderate CVE-2023-3817 SUSE bug 1213853 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. Moderate CVE-2023-38325 SUSE bug 1213378 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. Important CVE-2023-38408 SUSE bug 1213504 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info). Low CVE-2023-38409 SUSE bug 1213417 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length. Critical CVE-2023-38426 SUSE bug 1213421 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts. Critical CVE-2023-38427 SUSE bug 1213422 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read. Critical CVE-2023-38428 SUSE bug 1213423 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access. Critical CVE-2023-38429 SUSE bug 1213424 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read. Critical CVE-2023-38430 SUSE bug 1213425 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read. Critical CVE-2023-38431 SUSE bug 1213426 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read. Critical CVE-2023-38432 SUSE bug 1213427 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. Important CVE-2023-38545 SUSE bug 1215888 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course. Moderate CVE-2023-38546 SUSE bug 1215889 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue. Important CVE-2023-3863 SUSE bug 1213601 SUSE bug 1213603 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. Important CVE-2023-38633 SUSE bug 1213502 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-3865 SUSE bug 1213813 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-3866 SUSE bug 1213814 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability to call arbitrary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to an adversary, becomes accessible through this bug. Moderate CVE-2023-38898 SUSE bug 1214314 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Divide By Zero in vim/vim from?9.0.1367-1 to?9.0.1367-3 Moderate CVE-2023-3896 SUSE bug 1214051 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** CVE-2023-39190 was found to be a duplicate of CVE-2023-31436. Please see https://access.redhat.com/security/cve/CVE-2023-31436 for information about affected products and security errata. Low CVE-2023-39190 SUSE bug 1216056 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel. Important CVE-2023-39191 SUSE bug 1215863 SUSE bug 1215887 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-3961 SUSE bug 1215907 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** DISPUTED ** Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. Moderate CVE-2023-39615 SUSE bug 1214768 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. Moderate CVE-2023-3978 SUSE bug 1213933 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. Important CVE-2023-4004 SUSE bug 1213812 SUSE bug 1214812 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. Important CVE-2023-4015 SUSE bug 1215104 SUSE bug 1215106 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. Low CVE-2023-4016 SUSE bug 1214290 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) Important CVE-2023-40217 SUSE bug 1214692 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. Moderate CVE-2023-40283 SUSE bug 1214233 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled. Moderate CVE-2023-40360 SUSE bug 1214287 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. Important CVE-2023-4039 SUSE bug 1214052 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-40660 SUSE bug 1215762 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-40661 SUSE bug 1215761 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page. Low CVE-2023-40791 SUSE bug 1216255 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-4091 SUSE bug 1215904 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x. Moderate CVE-2023-41105 SUSE bug 1214693 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. Moderate CVE-2023-4128 SUSE bug 1214149 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition. Moderate CVE-2023-4132 SUSE bug 1213969 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition. Moderate CVE-2023-4133 SUSE bug 1213970 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-4134 SUSE bug 1213971 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed. Moderate CVE-2023-4135 SUSE bug 1213975 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system. Important CVE-2023-4147 SUSE bug 1213968 SUSE bug 1215118 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-4154 SUSE bug 1215908 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`). Moderate CVE-2023-4155 SUSE bug 1214022 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. Low CVE-2023-4156 SUSE bug 1214025 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate. Moderate CVE-2023-4194 SUSE bug 1214019 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** This was deemed as a false positive both by the reporter and upstream kernel. Low CVE-2023-4205 SUSE bug 1214050 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately. Moderate CVE-2023-42467 SUSE bug 1215192 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-42669 SUSE bug 1215905 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-42670 SUSE bug 1215906 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. Important CVE-2023-4273 SUSE bug 1214120 SUSE bug 1214123 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers. Moderate CVE-2023-42752 SUSE bug 1215146 SUSE bug 1215468 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. Moderate CVE-2023-42753 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system. Moderate CVE-2023-42756 SUSE bug 1215767 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system. Low CVE-2023-43785 SUSE bug 1215683 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. Low CVE-2023-43786 SUSE bug 1215682 SUSE bug 1215684 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. Low CVE-2023-43787 SUSE bug 1215682 SUSE bug 1215685 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5. Moderate CVE-2023-43804 SUSE bug 1215968 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check. Moderate CVE-2023-4385 SUSE bug 1214348 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem. Moderate CVE-2023-4387 SUSE bug 1214350 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information. Moderate CVE-2023-4389 SUSE bug 1214351 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information Moderate CVE-2023-4394 SUSE bug 1214352 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32. Important CVE-2023-44466 SUSE bug 1215871 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup. Moderate CVE-2023-4459 SUSE bug 1214451 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. Important CVE-2023-4504 SUSE bug 1215204 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. Important CVE-2023-4527 SUSE bug 1215280 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2023-4535 SUSE bug 1215763 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause a double-deactivations of catchall elements, which results in a memory leak. Low CVE-2023-4569 SUSE bug 1214729 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent. Low CVE-2023-45898 SUSE bug 1216262 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak. Moderate CVE-2023-4611 SUSE bug 1214772 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. Important CVE-2023-4622 SUSE bug 1215117 SUSE bug 1215442 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. Important CVE-2023-4623 SUSE bug 1215115 SUSE bug 1215440 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2023-4641 SUSE bug 1214806 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x. Moderate CVE-2023-4732 SUSE bug 1214926 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.1840. Important CVE-2023-4733 SUSE bug 1215004 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Moderate CVE-2023-4734 SUSE bug 1214925 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Low CVE-2023-4735 SUSE bug 1214924 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Important CVE-2023-4736 SUSE bug 1214923 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. Important CVE-2023-4738 SUSE bug 1214922 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.1858. Important CVE-2023-4752 SUSE bug 1215006 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Important CVE-2023-4781 SUSE bug 1215033 SUSE bug 1215457 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. Moderate CVE-2023-4806 SUSE bug 1215281 SUSE bug 1215714 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue. Important CVE-2023-4807 SUSE bug 1215170 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge. Moderate CVE-2023-4813 SUSE bug 1215286 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team. Moderate CVE-2023-4881 SUSE bug 1215221 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges. Important CVE-2023-4911 SUSE bug 1215501 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. Important CVE-2023-4921 SUSE bug 1215275 SUSE bug 1215300 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. Low CVE-2023-5156 SUSE bug 1215714 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor. Moderate CVE-2023-5158 SUSE bug 1215710 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705. Moderate CVE-2023-5345 SUSE bug 1215899 SUSE bug 1215971 cpe:/o:suse:suse-microos:5.2 SUSE Linux Enterprise Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-5388 SUSE bug 1216198 cpe:/o:suse:suse-microos:5.2