Summary
It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14895, CVE-2019-14901)
It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2019-14896, CVE-2019-14897)
Anthony Steinhauser discovered that the Linux kernel did not properly
perform Spectre_RSB mitigations to all processors for PowerPC architecture
systems in some situations. A local attacker could use this to expose
sensitive information. (CVE-2019-18660)
It was discovered that Geschwister Schneider USB CAN interface driver in
the Linux kernel did not properly deallocate memory in certain failure
conditions. A physically proximate attacker could use this to cause a
denial of service (kernel memory exhaustion). (CVE-2019-19052)
It was discovered that the driver for memoryless force-feedback input
devices in the Linux kernel contained a use-after-free vulnerability. A
physically proximate attacker could possibly use this to cause a denial of
service (system crash) or execute arbitrary code. (CVE-2019-19524)
It was discovered that the PEAK-System Technik USB driver in the Linux
kernel did not properly sanitize memory before sending it to the device. A
physically proximate attacker could use this to expose sensitive
information (kernel memory). (CVE-2019-19534)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux | 4.4.0-171.200 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-aws | 4.4.0-1100.111 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-kvm | 4.4.0-1064.71 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-raspi2 | 4.4.0-1127.136 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-snapdragon | 4.4.0-1131.139 |
Vulnerabilities 8
-
High 8.8CVE-2019-14901 EPSS 16%
A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip dr…
-
High 8.0
A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell…
-
High 7.8
A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip d…
-
Medium 6.6
A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att…
-
Unscored —
The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place…
-
Unscored —
A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows at…
-
Unscored —
In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the dr…
-
Unscored —
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the driver…
References
-
report
https://ubuntu.com/security/CVE-2019-14895
-
report
https://ubuntu.com/security/CVE-2019-14896
-
report
https://ubuntu.com/security/CVE-2019-14897
-
report
https://ubuntu.com/security/CVE-2019-14901
-
report
https://ubuntu.com/security/CVE-2019-18660
-
report
https://ubuntu.com/security/CVE-2019-19052
-
report
https://ubuntu.com/security/CVE-2019-19524
-
report
https://ubuntu.com/security/CVE-2019-19534