Debian Linux vulnerabilities

CVE-2021-47489 [MEDIUM] CVE-2021-47489: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix even more out of bound writes from debugfs CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issue so fix th

CVE-2016-2070 [HIGH] CVE-2016-2070: linux - The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel befo... The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel before 4.3.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via crafted TCP traffic. Scope: local bookworm: resolved (fixed in 4.3.5-1) bullseye: resolved (fixed in 4.3.5-1) forky: resolved (fixed in 4.3.5-1) sid: resolved (fixed in 4.3.5-1) trixie:

CVE-2015-8746 [HIGH] CVE-2015-8746: linux - fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not pr... fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic. Scope: local bookworm: resolved (fixed in 4.3.1-1) bullseye: resolved (fixed in 4.3.1-1) forky: resolved

CVE-2017-2583 [HIGH] CVE-2017-2583: linux - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linu... The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL selector" instruction, which allows guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application. Scope: local bookworm: resolved (fixed in 4.9.6-1) bullseye: resolved (fixed in 4.

CVE-2015-8550 [HIGH] CVE-2015-8550: linux - Xen, when used on a system providing PV backends, allows local guest OS administ... Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability. Scope: local bookworm: resolved (fixed in 4.3.3-3) bullseye: resolved (fixed in 4.3.3-3) forky: resolved (fixed in 4.3.3-3) s

CVE-2015-8961 [HIGH] CVE-2015-8961: linux - The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel befo... The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field. Scope: local bookworm: resolved (fixed in 4.3.3-1) bullseye: resolved (fixed in 4.3.3-1) forky: resolved (fixed in 4.3.3-1) sid: resolved (fixe

CVE-2021-47456 [HIGH] CVE-2021-47456: linux - In the Linux kernel, the following vulnerability has been resolved: can: peak_p... In the Linux kernel, the following vulnerability has been resolved: can: peak_pci: peak_pci_remove(): fix UAF When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will cause UAF. Fix this by releasing 'dev' later. The following log reveals it: [ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414 ] Re

CVE-2016-9120 [HIGH] CVE-2016-9120: linux - Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in... Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time. Scope: local bookworm: resolved (fixed in 4.6.1-1) bullseye: resolved (fixed in 4.6.1-1) forky: resolved (fixed in 4.6.1-1) s

CVE-2018-5703 [CRITICAL] CVE-2018-5703: linux - The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel thr... The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via vectors involving TLS. Scope: local bookworm: resolved (fixed in 4.15.11-1) bullseye: resolved (fixed in 4.15.11-1) forky: resolved (fixed in 4.15.11-1) sid

CVE-2016-7911 [HIGH] CVE-2016-7911: linux - Race condition in the get_task_ioprio function in block/ioprio.c in the Linux ke... Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call. Scope: local bookworm: resolved (fixed in 4.7.2-1) bullseye: resolved (fixed in 4.7.2-1) forky: resolved (fixed in 4.7.2-1) sid: resolved (fixed in 4.7.

CVE-2023-3867 [HIGH] CVE-2023-3867: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup(). Scope: local bookworm: resolved (fixed in

CVE-2022-29968 [HIGH] CVE-2022-29968: linux - An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in f... An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private. Scope: local bookworm: resolved (fixed in 5.17.6-1) bullseye: resolved forky: resolved (fixed in 5.17.6-1) sid: resolved (fixed in 5.17.6-1) trixie: resolved (fixed in 5.17.6-1)

CVE-2014-9870 [HIGH] CVE-2014-9870: linux - The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08... The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly consider user-space access to the TPIDRURW register, which allows local users to gain privileges via a crafted application, aka Android internal bug 28749743 and Qualcomm internal bug CR561044. Scope: local bookworm: resolved (fixed in 3

CVE-2019-14816 [HIGH] CVE-2019-14816: linux - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3... There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: reso

CVE-2019-14814 [HIGH] CVE-2019-14814: linux - There is heap-based buffer overflow in Linux kernel, all versions up to, excludi... There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid

CVE-2015-9004 [HIGH] CVE-2015-9004: linux - kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping... kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions. Scope: local bookworm: resolved (fixed in 3.16.7-ckt7-1) bullseye: resolved (fixed in 3.16.7-ckt7-1) forky: resolved (fixed in 3.16.7-ckt7-1) sid: resolved

CVE-2017-7374 [HIGH] CVE-2017-7374: linux - Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 all... Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer dereference) or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be freed prematurely. Scope: local bookworm: resolved (fixed in 4.9.25-1) bu

CVE-2019-8912 [HIGH] CVE-2019-8912: linux - In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglect... In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr. Scope: local bookworm: resolved (fixed in 4.19.28-1) bullseye: resolved (fixed in 4.19.28-1) forky: resolved (fixed in 4.19.28-1) sid: resolved (fixed in 4.19.28-1) trixie: resolved (fixe

CVE-2019-15918 [HIGH] CVE-2019-15918: linux - An issue was discovered in the Linux kernel before 5.0.10. SMB2_negotiate in fs/... An issue was discovered in the Linux kernel before 5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an out-of-bounds read because data structures are incompletely updated after a change from smb30 to smb21. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie:

CVE-2014-7826 [HIGH] CVE-2014-7826: linux - kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not proper... kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. Scope: local bookworm: resolved (fixed in 3.16.7-ckt2-1) bullseye: resolved (fixed in 3.16.7