Professional OVAL Repository
[Eng]
[Rus]
[Sign-In]
OVAL
Search
Categories
RedCheck
About
OVAL Definitions
OVAL Items
FSTEC Data Bank Information Security Threats
NKCKI
EOL (End Of Life)
Linux Security Advisories
Mozilla Foundation Security Advisory
IBM
VMware
Cisco
Check Point Software Technologies
Apache
Solaris
FreeBSD
Development
GitHub Enterprise
Google Chrome Security Advisories
Oracle Security Advisories
Adobe Security Advisories
OpenSSL Security Advisories
Microsoft
CVE
CWE
CPE
Latest Updates
OS ROSA
ALT Linux
Astra Linux SE 1.5
Astra Linux SE 1.6
RED OS
DSA (Debian Security Advisory) Patсh Statistics
DSA (Debian Security Advisory) Patсh Feed
DSA (Debian Security Advisory) Vulnerability Feed
DLA (Debian Security Advisory) Patсh Statistics
DLA (Debian Security Advisory) Patсh Feed
DLA (Debian Security Advisory) Vulnerability Feed
ALT Linux (Security Bulletins) Patсh Statistics
ALT Linux (Security Bulletins) Patсh Feed
ALT Linux (Security Bulletins) Vulnerability Feed
RED OS (Security Bulletins) Patсh Statistics
RED OS (Security Bulletins) Patсh Feed
RED OS (Security Bulletins) Vulnerability Feed
USN (Ubuntu Security Notice) Patсh Statistics
USN (Ubuntu Security Notice) Patсh Feed
USN (Ubuntu Security Notice) Vulnerability Feed
RHSA (RedHat Security Advisory) Patсh Statistics
RHSA (RedHat Security Advisory) Patсh Feed
RHSA (RedHat Security Advisory) Vulnerability Feed
ELSA (Oracle Linux Security Advisory) Patсh Statistics
ELSA (Oracle Linux Security Advisory) Patсh Feed
ELSA (Oracle Linux Security Advisory) Vulnerability Feed
SUSE (SUSE Security Advisories) Patсh Statistics
SUSE (SUSE Security Advisories) Patсh Feed
SUSE (SUSE Security Advisories) Vulnerability Feed
openSUSE (openSUSE Security Advisories) Patсh Statistics
openSUSE (openSUSE Security Advisories) Patсh Feed
openSUSE (openSUSE Security Advisories) Vulnerability Feed
Amazon Linux AMI (Security Bulletins) Patсh Statistics
Amazon Linux AMI (Security Bulletins) Patсh Feed
Amazon Linux AMI (Security Bulletins) Vulnerability Feed
Mageia Linux (Security Bulletins) Patсh Statistics
Mageia Linux (Security Bulletins) Patсh Feed
Mageia Linux (Security Bulletins) Vulnerability Feed
OS ROSA SX COBALT 1.0
OS ROSA DX COBALT 1.0
ROSA 7.3 (Security Advisories) Patсh Statistics
ROSA 7.3 (Security Advisories) Patсh Feed
ROSA 7.3 (Security Advisories) Vulnerability Feed
ALT Linux SPT 6.0
ALT Linux SPT 7.0
ALT 8 SP
ALT 9
RED OS Murom 7.1
RED OS Murom 7.2
IBM DB2
VMware Vulnerabilities Advisory (VMSA)
VMware vCenter Patch Advisories
VMware ESXi Patch Advisories
VMware NSX Patches
VMware NSX Vulnerabilities
VMware Photon OS 1.0 Patches
VMware Photon OS 1.0 Vulnerabilities
VMware Photon OS 2.0 Patches
VMware Photon OS 2.0 Vulnerabilities
Cisco ASA
Cisco IOS/NX-OS Advisory
Cisco NX-OS Vulnerabilities
Check Point Gaia
Apache Tomcat Advisories
Apache Tomcat Server
Apache HTTP Server
Python
Node.js
RubyGems
Qt
Microsoft Security Bulletin
Microsoft Knowledge Base Article
Microsoft SharePoint
Microsoft SharePoint Foundation 2013
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016
About OVALdb
User manual
Pricing
Contact us
OVAL Definitions
>
OVAL Definition Details
Id
oval:com.altx-soft.nix:def:127129
[Rus]
Version
1
Class
patch
ALTXid
317148
Language
English
Severity
Medium
Title
USN-4286-1 -- Linux kernel vulnerabilities
Description
Several security issues were fixed in Linux Kernel.
Family
unix
Platform
Linux Mint 18.x
Ubuntu 16.04
Product
linux
linux-aws
linux-kvm
linux-raspi2
linux-snapdragon
Reference
VENDOR: USN-4286-1
VENDOR: USN-4286-1
Id:
USN-4286-1
Reference:
https://usn.ubuntu.com/4286-1/
CVE: CVE-2019-14615
CVE: CVE-2019-14615
Id:
CVE-2019-14615
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14615
Comment
: Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
CVSSv2 Score:
1.9
Access vector:
LOCAL
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:L/AC:M/Au:N/C:P/I:N/A:N
CVSSv3 Score:
5.5
Attack vector:
LOCAL
Attack complexity:
LOW
Privileges required:
NONE
User interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality impact:
HIGH
Integrity impact:
NONE
Availability impact:
NONE
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html (CONFIRM)
USN-4254-1 (UBUNTU)
USN-4255-1 (UBUNTU)
USN-4253-1 (UBUNTU)
USN-4254-2 (UBUNTU)
USN-4253-2 (UBUNTU)
USN-4255-2 (UBUNTU)
http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html (MISC)
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html (MISC)
USN-4285-1 (UBUNTU)
USN-4287-1 (UBUNTU)
USN-4286-2 (UBUNTU)
USN-4287-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4284-1 (UBUNTU)
USN-4286-1 (UBUNTU)
openSUSE-SU-2020:0336 (SUSE)
https://support.apple.com/kb/HT211100 (CONFIRM)
20200324 APPLE-SA-2020-03-24-2 macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra (FULLDISC)
CVE: CVE-2019-15220
CVE: CVE-2019-15220
Id:
CVE-2019-15220
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15220
Comment
: An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSSv3 Score:
4.6
Attack vector:
PHYSICAL
Attack complexity:
LOW
Privileges required:
NONE
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE:
416 (Use After Free)
References:
https://syzkaller.appspot.com/bug?id=082c09653e43e33a6a56f8c57cf051eeacae9d5f (MISC)
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.1 (MISC)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e41e2257f1094acc37618bf6c856115374c6922 (MISC)
[oss-security] 20190820 Linux kernel: multiple vulnerabilities in the USB subsystem x2 (MLIST)
USN-4115-1 (UBUNTU)
USN-4118-1 (UBUNTU)
https://security.netapp.com/advisory/ntap-20190905-0002/ (CONFIRM)
[debian-lts-announce] 20190914 [SECURITY] [DLA 1919-1] linux-4.9 security update (MLIST)
[debian-lts-announce] 20190915 [SECURITY] [DLA 1919-2] linux-4.9 security update (MLIST)
openSUSE-SU-2019:2173 (SUSE)
openSUSE-SU-2019:2181 (SUSE)
[debian-lts-announce] 20190925 [SECURITY] [DLA 1930-1] linux security update (MLIST)
USN-4147-1 (UBUNTU)
USN-4286-2 (UBUNTU)
USN-4286-1 (UBUNTU)
CVE: CVE-2019-17351
CVE: CVE-2019-17351
Id:
CVE-2019-17351
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17351
Comment
: An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSSv3 Score:
6.5
Attack vector:
LOCAL
Attack complexity:
LOW
Privileges required:
LOW
User interaction:
NONE
Scope:
CHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CWE:
770 (Allocation of Resources Without Limits or Throttling)
References:
https://github.com/torvalds/linux/commit/6ef36ab967c71690ebe7e5ef997a8be4da3bc844 (MISC)
https://xenbits.xen.org/xsa/advisory-300.html (MISC)
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3 (MISC)
[oss-security] 20191025 Xen Security Advisory 300 v3 (CVE-2019-17351) - Linux: No grant table and foreign mapping limits (MLIST)
http://xenbits.xen.org/xsa/advisory-300.html (CONFIRM)
https://security.netapp.com/advisory/ntap-20191031-0005/ (CONFIRM)
USN-4286-2 (UBUNTU)
USN-4286-1 (UBUNTU)
CVE: CVE-2019-19051
CVE: CVE-2019-19051
Id:
CVE-2019-19051
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19051
Comment
: A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSSv3 Score:
5.5
Attack vector:
LOCAL
Attack complexity:
LOW
Privileges required:
LOW
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE:
401 (Improper Release of Memory Before Removing Last Reference ('Memory Leak'))
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 (MISC)
https://github.com/torvalds/linux/commit/6f3ef5c25cc762687a7341c18cbea5af54461407 (MISC)
https://security.netapp.com/advisory/ntap-20191205-0001/ (CONFIRM)
USN-4225-1 (UBUNTU)
[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update (MLIST)
USN-4225-2 (UBUNTU)
USN-4286-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4286-1 (UBUNTU)
openSUSE-SU-2020:0336 (SUSE)
USN-4302-1 (UBUNTU)
USN-4344-1 (UBUNTU)
CVE: CVE-2019-19056
CVE: CVE-2019-19056
Id:
CVE-2019-19056
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19056
Comment
: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932.
CVSSv2 Score:
4.7
Access vector:
LOCAL
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:M/Au:N/C:N/I:N/A:C
CVSSv3 Score:
4.7
Attack vector:
LOCAL
Attack complexity:
HIGH
Privileges required:
LOW
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE:
401 (Improper Release of Memory Before Removing Last Reference ('Memory Leak'))
References:
https://github.com/torvalds/linux/commit/db8fd2cde93227e566a412cf53173ffa227998bc (MISC)
https://security.netapp.com/advisory/ntap-20191205-0001/ (CONFIRM)
openSUSE-SU-2019:2675 (SUSE)
[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update (MLIST)
USN-4286-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4286-1 (UBUNTU)
USN-4300-1 (UBUNTU)
USN-4301-1 (UBUNTU)
USN-4302-1 (UBUNTU)
FEDORA-2019-021c968423 ()
FEDORA-2019-34a75d7e61 ()
CVE: CVE-2019-19066
CVE: CVE-2019-19066
Id:
CVE-2019-19066
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19066
Comment
: A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.
CVSSv2 Score:
4.7
Access vector:
LOCAL
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:M/Au:N/C:N/I:N/A:C
CVSSv3 Score:
4.7
Attack vector:
LOCAL
Attack complexity:
HIGH
Privileges required:
LOW
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE:
401 (Improper Release of Memory Before Removing Last Reference ('Memory Leak'))
References:
https://github.com/torvalds/linux/commit/0e62395da2bd5166d7c9e14cbc7503b256a34cb0 (MISC)
https://security.netapp.com/advisory/ntap-20191205-0001/ (CONFIRM)
[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update (MLIST)
USN-4286-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4286-1 (UBUNTU)
openSUSE-SU-2020:0336 (SUSE)
USN-4300-1 (UBUNTU)
USN-4301-1 (UBUNTU)
USN-4302-1 (UBUNTU)
https://www.oracle.com/security-alerts/cpuApr2021.html (MISC)
FEDORA-2019-021c968423 ()
FEDORA-2019-34a75d7e61 ()
CVE: CVE-2019-19068
CVE: CVE-2019-19068
Id:
CVE-2019-19068
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19068
Comment
: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSSv3 Score:
4.6
Attack vector:
PHYSICAL
Attack complexity:
LOW
Privileges required:
NONE
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE:
401 (Improper Release of Memory Before Removing Last Reference ('Memory Leak'))
References:
https://github.com/torvalds/linux/commit/a2cdd07488e666aa93a49a3fc9c9b1299e27ef3c (MISC)
https://security.netapp.com/advisory/ntap-20191205-0001/ (CONFIRM)
openSUSE-SU-2019:2675 (SUSE)
USN-4286-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4286-1 (UBUNTU)
USN-4300-1 (UBUNTU)
USN-4301-1 (UBUNTU)
USN-4302-1 (UBUNTU)
FEDORA-2019-021c968423 ()
FEDORA-2019-34a75d7e61 ()
CVE: CVE-2019-19965
CVE: CVE-2019-19965
Id:
CVE-2019-19965
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19965
Comment
: In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.
CVSSv2 Score:
1.9
Access vector:
LOCAL
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:L/AC:M/Au:N/C:N/I:N/A:P
CVSSv3 Score:
4.7
Attack vector:
LOCAL
Attack complexity:
HIGH
Privileges required:
LOW
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE:
476 (NULL Pointer Dereference)
References:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f70267f379b5e5e11bdc5d72a56bf17e5feed01f (MISC)
[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update (MLIST)
https://security.netapp.com/advisory/ntap-20200204-0002/ (CONFIRM)
USN-4285-1 (UBUNTU)
USN-4287-1 (UBUNTU)
USN-4286-2 (UBUNTU)
USN-4287-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4284-1 (UBUNTU)
USN-4286-1 (UBUNTU)
openSUSE-SU-2020:0336 (SUSE)
CVE: CVE-2019-20096
CVE: CVE-2019-20096
Id:
CVE-2019-20096
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20096
Comment
: In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSSv3 Score:
5.5
Attack vector:
LOCAL
Attack complexity:
LOW
Privileges required:
LOW
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE:
401 (Improper Release of Memory Before Removing Last Reference ('Memory Leak'))
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1 (MISC)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1d3ff0950e2b40dc861b1739029649d03f591820 (MISC)
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html (MISC)
USN-4285-1 (UBUNTU)
USN-4287-1 (UBUNTU)
USN-4286-2 (UBUNTU)
USN-4287-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4286-1 (UBUNTU)
openSUSE-SU-2020:0336 (SUSE)
CVE: CVE-2019-5108
CVE: CVE-2019-5108
Id:
CVE-2019-5108
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5108
Comment
: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
CVSSv2 Score:
3.3
Access vector:
ADJACENT_NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:A/AC:L/Au:N/C:N/I:N/A:P
CVSSv3 Score:
6.5
Attack vector:
ADJACENT_NETWORK
Attack complexity:
LOW
Privileges required:
NONE
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE:
287 (Improper Authentication)
References:
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900 (MISC)
https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e (MISC)
https://security.netapp.com/advisory/ntap-20200204-0002/ (CONFIRM)
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html (MISC)
USN-4285-1 (UBUNTU)
USN-4287-1 (UBUNTU)
USN-4286-2 (UBUNTU)
USN-4287-2 (UBUNTU)
USN-4286-1 (UBUNTU)
[debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update (MLIST)
[debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update (MLIST)
[debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update (MLIST)
DSA-4698 (DEBIAN)
https://www.oracle.com/security-alerts/cpuApr2021.html (MISC)
CVE: CVE-2019-15217
CVE: CVE-2019-15217
Id:
CVE-2019-15217
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15217
Comment
: An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSSv3 Score:
4.6
Attack vector:
PHYSICAL
Attack complexity:
LOW
Privileges required:
NONE
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE:
476 (NULL Pointer Dereference)
References:
https://syzkaller.appspot.com/bug?id=9c0c178c24d828a7378f483309001329750aad64 (MISC)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e (MISC)
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3 (MISC)
[oss-security] 20190820 Linux kernel: multiple vulnerabilities in the USB subsystem x2 (MLIST)
[oss-security] 20190822 Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (MLIST)
[oss-security] 20190822 Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (MLIST)
[oss-security] 20190822 Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (MLIST)
[oss-security] 20190822 Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (MLIST)
https://security.netapp.com/advisory/ntap-20190905-0002/ (CONFIRM)
openSUSE-SU-2019:2173 (SUSE)
openSUSE-SU-2019:2181 (SUSE)
USN-4147-1 (UBUNTU)
[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update (MLIST)
USN-4286-2 (UBUNTU)
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update (MLIST)
USN-4286-1 (UBUNTU)
USN-4302-1 (UBUNTU)
CVE: CVE-2019-15221
CVE: CVE-2019-15221
Id:
CVE-2019-15221
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15221
Comment
: An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSSv3 Score:
4.6
Attack vector:
PHYSICAL
Attack complexity:
LOW
Privileges required:
NONE
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE:
476 (NULL Pointer Dereference)
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17 (MISC)
https://syzkaller.appspot.com/bug?id=240f09164db2c3d3af33a117c713dc7650dc29d6 (MISC)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3450121997ce872eb7f1248417225827ea249710 (MISC)
[oss-security] 20190820 Linux kernel: multiple vulnerabilities in the USB subsystem x2 (MLIST)
USN-4115-1 (UBUNTU)
USN-4118-1 (UBUNTU)
https://security.netapp.com/advisory/ntap-20190905-0002/ (CONFIRM)
[debian-lts-announce] 20190914 [SECURITY] [DLA 1919-1] linux-4.9 security update (MLIST)
[debian-lts-announce] 20190915 [SECURITY] [DLA 1919-2] linux-4.9 security update (MLIST)
openSUSE-SU-2019:2173 (SUSE)
openSUSE-SU-2019:2181 (SUSE)
[debian-lts-announce] 20190925 [SECURITY] [DLA 1930-1] linux security update (MLIST)
USN-4147-1 (UBUNTU)
USN-4286-2 (UBUNTU)
USN-4286-1 (UBUNTU)
Content available only for registered users!
ovaldb@altx-soft.com