Skip to content
OpenAdvisories
High ELSA-2014-3049 3 CVEs

Important: unbreakable enterprise kernel security update (Oracle Linux 7)

Published Jul 23, 2014 · Updated Jul 23, 2014

Ecosystem: Oracle Linux

Summary

kernel-uek
[3.8.13-35.3.2.el7uek]
- l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin) [Orabug: 19229497] {CVE-2014-4943} {CVE-2014-4943}
- ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo) [Orabug: 19230689] {CVE-2014-4699}
- net: flow_dissector: fail on evil iph->ihl (Jason Wang) [Orabug: 19231234] {CVE-2013-4348}

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 7 dtrace-modules-3.8.13-35.3.2.el7uek 0:0.4.3-4.el7
Oracle Linux · 7 kernel-uek 0:3.8.13-35.3.2.el7uek
Oracle Linux · 7 kernel-uek-debug 0:3.8.13-35.3.2.el7uek
Oracle Linux · 7 kernel-uek-debug-devel 0:3.8.13-35.3.2.el7uek
Oracle Linux · 7 kernel-uek-devel 0:3.8.13-35.3.2.el7uek
Oracle Linux · 7 kernel-uek-doc 0:3.8.13-35.3.2.el7uek
Oracle Linux · 7 kernel-uek-firmware 0:3.8.13-35.3.2.el7uek

Vulnerabilities 3

  • Unscored —
    CVE-2013-4348 Public exploit

    The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to …

    linux Debian
  • Unscored —
    CVE-2014-4699 Public exploit

    The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the save…

    linux linux Debian Ubuntu
  • Unscored —
    CVE-2014-4943 Public exploit

    The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by…

    linux linux Debian Ubuntu