Summary
Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled
the IPC interface. A local attacker could possibly use this issue to
execute arbitrary code with root privileges. (CVE-2016-7035)
Alain Moulle discovered that Pacemaker incorrectly handled authentication.
A remote attacker could possibly use this issue to shut down connections,
leading to a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-7797)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | pacemaker | 1.1.10+git20130802-1ubuntu2.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | pacemaker | 1.1.14-2ubuntu1.2 |
Vulnerabilities 2
-
High 8.8
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attac…
-
Unscored —
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node d…