Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 9 | linux | 4.9.168-1+deb9u3 |
Vulnerabilities 13
-
High 8.0
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel modu…
-
High 7.9
Broadcom brcmfmac driver is vulnerable to a heap buffer overflow
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffe…
-
High 7.9
Broadcom brcmfmac driver is vulnerable to a frame validation bypass
The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this…
-
High 7.5
Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fi…
-
Medium 5.9
A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/ne…
-
Medium 5.3
SACK can cause extensive memory use via fragmented resend queue
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of serv…
-
Medium 5.3CVE-2019-11479 EPSS 91%
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fr…
-
Unscored —
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race co…
-
Unscored —CVE-2019-11599 Public exploit
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma l…
-
Unscored —
An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race conditi…
-
Unscored —
fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block…
-
Unscored —
The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to o…
-
Unscored —CVE-2019-5489 Public exploit
The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe pag…