High ELSA-2017-3621 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

Published Sep 20, 2017 · Updated Sep 20, 2017

Ecosystem: Oracle Linux

Summary

kernel-uek
[3.8.13-118.19.7]
- Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri) [Orabug: 26796364] {CVE-2017-1000251}

[3.8.13-118.19.6]
- xen: fix bio vec merging (Roger Pau Monne) [Orabug: 26645550] {CVE-2017-12134}

[3.8.13-118.19.5]
- fs/exec.c: account for argv/envp pointers (Kees Cook) [Orabug: 26638921] {CVE-2017-1000365} {CVE-2017-1000365}

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 7	dtrace-modules-3.8.13-118.19.7.el6uek	0:0.4.5-3.el6
Oracle Linux · 7	dtrace-modules-3.8.13-118.19.7.el7uek	0:0.4.5-3.el7
Oracle Linux · 7	kernel-uek	0:3.8.13-118.19.7.el7uek
Oracle Linux · 7	kernel-uek-debug	0:3.8.13-118.19.7.el7uek
Oracle Linux · 7	kernel-uek-debug-devel	0:3.8.13-118.19.7.el7uek
Oracle Linux · 7	kernel-uek-devel	0:3.8.13-118.19.7.el7uek
Oracle Linux · 7	kernel-uek-doc	0:3.8.13-118.19.7.el7uek
Oracle Linux · 7	kernel-uek-firmware	0:3.8.13-118.19.7.el7uek

Vulnerabilities 3

Unscored —

CVE-2017-1000251 Public exploit EPSS 16%

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and inclu…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 12, 2017
Unscored —

CVE-2017-1000365

The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM…

linux-raspi2 linux-hwe linux-riscv linux Debian Ubuntu

Jun 19, 2017
Unscored —

CVE-2017-12134

The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt blo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 24, 2017