Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-1065 (GCVE-0-2018-1065)
Vulnerability from cvelistv5 – Published: 2018-03-02 08:00 – Updated: 2024-08-05 03:51
VLAI?
EPSS
Summary
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
Severity ?
No CVSS data available.
CWE
- NULL pointer dereference
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Linux kernel 4.15.0-rc9 |
Affected:
Linux kernel 4.15.0-rc9
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:51:47.324Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1040446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1040446"
},
{
"name": "USN-3654-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3654-1/"
},
{
"name": "DSA-4188",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4188"
},
{
"name": "RHSA-2018:2948",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824"
},
{
"name": "USN-3654-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3654-2/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://lists.openwall.net/netdev/2018/01/27/46"
},
{
"name": "USN-3656-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3656-1/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://patchwork.ozlabs.org/patch/870355/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Linux kernel 4.15.0-rc9",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Linux kernel 4.15.0-rc9"
}
]
}
],
"datePublic": "2018-03-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "NULL pointer dereference",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-31T09:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "1040446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1040446"
},
{
"name": "USN-3654-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3654-1/"
},
{
"name": "DSA-4188",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4188"
},
{
"name": "RHSA-2018:2948",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824"
},
{
"name": "USN-3654-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3654-2/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://lists.openwall.net/netdev/2018/01/27/46"
},
{
"name": "USN-3656-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3656-1/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://patchwork.ozlabs.org/patch/870355/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2018-1065",
"datePublished": "2018-03-02T08:00:00.000Z",
"dateReserved": "2017-12-04T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:51:47.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CERTFR-2018-AVI-250
Vulnerability from certfr_avis - Published: 2018-05-23 - Updated: 2018-05-23
De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu . Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Ubuntu 16.04 LTS",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 18.04 LTS",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 14.04 LTS",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 17.10",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 12.04 ESM",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-18193",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18193"
},
{
"name": "CVE-2017-17975",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17975"
},
{
"name": "CVE-2018-1068",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1068"
},
{
"name": "CVE-2017-18203",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18203"
},
{
"name": "CVE-2018-7480",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7480"
},
{
"name": "CVE-2017-13220",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13220"
},
{
"name": "CVE-2018-8781",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8781"
},
{
"name": "CVE-2017-18221",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18221"
},
{
"name": "CVE-2018-7757",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7757"
},
{
"name": "CVE-2017-18079",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18079"
},
{
"name": "CVE-2017-18222",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18222"
},
{
"name": "CVE-2018-8822",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8822"
},
{
"name": "CVE-2018-1130",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1130"
},
{
"name": "CVE-2017-18208",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18208"
},
{
"name": "CVE-2018-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3639"
},
{
"name": "CVE-2018-5803",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5803"
},
{
"name": "CVE-2018-7995",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7995"
},
{
"name": "CVE-2017-17449",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17449"
},
{
"name": "CVE-2017-18204",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18204"
},
{
"name": "CVE-2017-13305",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13305"
},
{
"name": "CVE-2018-1065",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1065"
},
{
"name": "CVE-2017-12134",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12134"
}
],
"initial_release_date": "2018-05-23T00:00:00",
"last_revision_date": "2018-05-23T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-250",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-05-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux\nd\u0027Ubuntu . Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une ex\u00e9cution de\ncode arbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux d\u0027Ubuntu",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3655-2 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3655-2/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3655-1 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3655-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3652-1 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3652-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3653-2 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3653-2/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3653-1 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3653-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3654-2 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3654-2/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3654-1 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3654-1/"
}
]
}
CERTFR-2018-AVI-320
Vulnerability from certfr_avis - Published: 2018-07-03 - Updated: 2018-07-03
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Google Android toutes versions n\u0027int\u00e9grant pas le correctif de s\u00e9curit\u00e9 du 02 juillet 2018",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-5865",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5865"
},
{
"name": "CVE-2017-1000",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1000"
},
{
"name": "CVE-2018-9412",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9412"
},
{
"name": "CVE-2018-5874",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5874"
},
{
"name": "CVE-2018-5862",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5862"
},
{
"name": "CVE-2018-5876",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5876"
},
{
"name": "CVE-2018-9428",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9428"
},
{
"name": "CVE-2017-18131",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18131"
},
{
"name": "CVE-2018-5703",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5703"
},
{
"name": "CVE-2018-11257",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11257"
},
{
"name": "CVE-2018-9365",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9365"
},
{
"name": "CVE-2017-18171",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18171"
},
{
"name": "CVE-2018-3570",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3570"
},
{
"name": "CVE-2018-9423",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9423"
},
{
"name": "CVE-2018-5872",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5872"
},
{
"name": "CVE-2017-13078",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13078"
},
{
"name": "CVE-2018-9426",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9426"
},
{
"name": "CVE-2018-5859",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5859"
},
{
"name": "CVE-2018-3586",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3586"
},
{
"name": "CVE-2018-5873",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5873"
},
{
"name": "CVE-2018-6927",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-6927"
},
{
"name": "CVE-2018-9411",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9411"
},
{
"name": "CVE-2018-9416",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9416"
},
{
"name": "CVE-2018-9430",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9430"
},
{
"name": "CVE-2018-9410",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9410"
},
{
"name": "CVE-2018-9424",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9424"
},
{
"name": "CVE-2018-11259",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11259"
},
{
"name": "CVE-2018-9376",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9376"
},
{
"name": "CVE-2018-5838",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5838"
},
{
"name": "CVE-2017-18279",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18279"
},
{
"name": "CVE-2017-18173",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18173"
},
{
"name": "CVE-2017-18275",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18275"
},
{
"name": "CVE-2018-5837",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5837"
},
{
"name": "CVE-2017-0606",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0606"
},
{
"name": "CVE-2018-9421",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9421"
},
{
"name": "CVE-2017-18172",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18172"
},
{
"name": "CVE-2017-18276",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18276"
},
{
"name": "CVE-2017-18170",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18170"
},
{
"name": "CVE-2018-9429",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9429"
},
{
"name": "CVE-2018-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5855"
},
{
"name": "CVE-2018-9433",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9433"
},
{
"name": "CVE-2018-11304",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11304"
},
{
"name": "CVE-2018-11258",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11258"
},
{
"name": "CVE-2018-9419",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9419"
},
{
"name": "CVE-2018-9413",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9413"
},
{
"name": "CVE-2018-7995",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7995"
},
{
"name": "CVE-2017-18277",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18277"
},
{
"name": "CVE-2018-5858",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5858"
},
{
"name": "CVE-2018-5875",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5875"
},
{
"name": "CVE-2018-9431",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9431"
},
{
"name": "CVE-2018-9420",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9420"
},
{
"name": "CVE-2018-9418",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9418"
},
{
"name": "CVE-2018-5882",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5882"
},
{
"name": "CVE-2017-1821",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1821"
},
{
"name": "CVE-2018-9415",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9415"
},
{
"name": "CVE-2018-9414",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9414"
},
{
"name": "CVE-2018-9434",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9434"
},
{
"name": "CVE-2018-9422",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9422"
},
{
"name": "CVE-2018-9417",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9417"
},
{
"name": "CVE-2017-18274",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18274"
},
{
"name": "CVE-2017-15841",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15841"
},
{
"name": "CVE-2017-15851",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15851"
},
{
"name": "CVE-2018-5864",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5864"
},
{
"name": "CVE-2018-5907",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5907"
},
{
"name": "CVE-2018-1065",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1065"
},
{
"name": "CVE-2017-18278",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18278"
},
{
"name": "CVE-2016-2108",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-2108"
},
{
"name": "CVE-2018-5878",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5878"
},
{
"name": "CVE-2018-9432",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9432"
},
{
"name": "CVE-2017-13077",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13077"
}
],
"initial_release_date": "2018-07-03T00:00:00",
"last_revision_date": "2018-07-03T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-320",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-07-03T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Pixel/Nexus du 02 juillet 2018",
"url": "https://source.android.com/security/bulletin/pixel/2018-07-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Android du 02 juillet 2018",
"url": "https://source.android.com/security/bulletin/2018-07-01"
}
]
}
CERTFR-2018-AVI-256
Vulnerability from certfr_avis - Published: 2018-05-25 - Updated: 2018-05-25
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 11-SP3-LTSS | ||
| SUSE | N/A | SUSE Linux Enterprise Module pour Public Cloud 12 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 12-SP2-LTSS | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server pour SAP 12-SP1 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 12-LTSS | ||
| SUSE | N/A | SUSE Linux Enterprise Debuginfo 11-SP4 | ||
| SUSE | SUSE Linux Enterprise Desktop | SUSE Linux Enterprise Desktop 12-SP3 | ||
| SUSE | N/A | SUSE Linux Enterprise Point of Sale 11-SP3 | ||
| SUSE | N/A | SUSE Linux Enterprise High Availability 12-SP2 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 11-SP4 | ||
| SUSE | N/A | OpenStack Cloud Magnum Orchestration 7 | ||
| SUSE | N/A | SUSE Linux Enterprise Software Development Kit 12-SP3 | ||
| SUSE | SUSE Linux Enterprise Live Patching | SUSE Linux Enterprise Live Patching 12-SP3 | ||
| SUSE | N/A | SUSE CaaS Platform ALL | ||
| SUSE | N/A | SUSE Linux Enterprise Software Development Kit 11-SP4 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 12-SP1-LTSS | ||
| SUSE | N/A | SUSE Linux Enterprise Debuginfo 11-SP3 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 12-SP3 | ||
| SUSE | N/A | SUSE OpenStack Cloud 7 | ||
| SUSE | N/A | SUSE Enterprise Storage 4 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server pour SAP 12-SP2 | ||
| SUSE | N/A | SUSE Linux Enterprise Workstation Extension 12-SP3 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 11-EXTRA | ||
| SUSE | N/A | SUSE Linux Enterprise High Availability 12-SP3 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SUSE Linux Enterprise Server 11-SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Module pour Public Cloud 12",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12-SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server pour SAP 12-SP1",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Debuginfo 11-SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Desktop 12-SP3",
"product": {
"name": "SUSE Linux Enterprise Desktop",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Point of Sale 11-SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Availability 12-SP2",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 11-SP4",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "OpenStack Cloud Magnum Orchestration 7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Software Development Kit 12-SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 12-SP3",
"product": {
"name": "SUSE Linux Enterprise Live Patching",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE CaaS Platform ALL",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Software Development Kit 11-SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12-SP1-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Debuginfo 11-SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12-SP3",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE OpenStack Cloud 7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Enterprise Storage 4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server pour SAP 12-SP2",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Workstation Extension 12-SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 11-EXTRA",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Availability 12-SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-1000199",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000199"
},
{
"name": "CVE-2018-7492",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7492"
},
{
"name": "CVE-2018-10675",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10675"
},
{
"name": "CVE-2018-8781",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8781"
},
{
"name": "CVE-2018-10124",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10124"
},
{
"name": "CVE-2018-1130",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1130"
},
{
"name": "CVE-2018-10087",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10087"
},
{
"name": "CVE-2018-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3639"
},
{
"name": "CVE-2018-5803",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5803"
},
{
"name": "CVE-2017-5753",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5753"
},
{
"name": "CVE-2017-5715",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
},
{
"name": "CVE-2018-1065",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1065"
}
],
"initial_release_date": "2018-05-25T00:00:00",
"last_revision_date": "2018-05-25T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-256",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-05-25T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de\nSUSE. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service,\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de SUSE",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2018:1366-1 du 22 mai 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181366-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2018:1376-1 du 22 mai 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181376-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2018:1375-1 du 22 mai 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181375-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2018:1368-1 du 22 mai 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181368-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2018:1377-1 du 22 mai 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181377-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2018:1374-1 du 22 mai 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181374-1/"
}
]
}
CERTFR-2018-AVI-308
Vulnerability from certfr_avis - Published: 2018-06-27 - Updated: 2018-06-27
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Real Time | SUSE Linux Enterprise Real Time Extension 12-SP3 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SUSE Linux Enterprise Real Time Extension 12-SP3",
"product": {
"name": "SUSE Linux Enterprise Real Time",
"vendor": {
"name": "SUSE",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-1000199",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000199"
},
{
"name": "CVE-2018-7492",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7492"
},
{
"name": "CVE-2018-1094",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1094"
},
{
"name": "CVE-2018-12233",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12233"
},
{
"name": "CVE-2018-8781",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8781"
},
{
"name": "CVE-2017-18241",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18241"
},
{
"name": "CVE-2018-5848",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5848"
},
{
"name": "CVE-2018-1130",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1130"
},
{
"name": "CVE-2017-18249",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18249"
},
{
"name": "CVE-2018-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3639"
},
{
"name": "CVE-2018-5803",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5803"
},
{
"name": "CVE-2018-3665",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3665"
},
{
"name": "CVE-2018-1093",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1093"
},
{
"name": "CVE-2018-1092",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1092"
},
{
"name": "CVE-2017-13305",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13305"
},
{
"name": "CVE-2018-1065",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1065"
},
{
"name": "CVE-2017-17741",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17741"
}
],
"initial_release_date": "2018-06-27T00:00:00",
"last_revision_date": "2018-06-27T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-308",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-06-27T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de\nSUSE. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service,\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de SUSE",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2018:1816-1 du 26 juin 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181816-1/"
}
]
}
CERTFR-2018-AVI-257
Vulnerability from certfr_avis - Published: 2018-05-25 - Updated: 2018-05-25
De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Ubuntu 16.04 LTS",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 17.10",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-18193",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18193"
},
{
"name": "CVE-2017-17975",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17975"
},
{
"name": "CVE-2018-1068",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1068"
},
{
"name": "CVE-2017-18203",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18203"
},
{
"name": "CVE-2018-7480",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7480"
},
{
"name": "CVE-2018-8781",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8781"
},
{
"name": "CVE-2018-7757",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7757"
},
{
"name": "CVE-2017-18222",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18222"
},
{
"name": "CVE-2018-8822",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8822"
},
{
"name": "CVE-2018-1130",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1130"
},
{
"name": "CVE-2017-18208",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18208"
},
{
"name": "CVE-2018-5803",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5803"
},
{
"name": "CVE-2018-7995",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7995"
},
{
"name": "CVE-2017-17449",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17449"
},
{
"name": "CVE-2018-1065",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1065"
}
],
"initial_release_date": "2018-05-25T00:00:00",
"last_revision_date": "2018-05-25T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-257",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-05-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "D\u00e9ni de service"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux\nd\u0027Ubuntu. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux d\u0027Ubuntu",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3657-1 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3657-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-3656-1 du 22 mai 2018",
"url": "https://usn.ubuntu.com/3656-1/"
}
]
}
CERTFR-2018-AVI-505
Vulnerability from certfr_avis - Published: 2018-10-19 - Updated: 2018-10-19
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE . Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 12-LTSS | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 12-SP2-BCL |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SUSE Linux Enterprise Server 12-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12-SP2-BCL",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-1000199",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000199"
},
{
"name": "CVE-2018-5391",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5391"
},
{
"name": "CVE-2018-1000204",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000204"
},
{
"name": "CVE-2018-1087",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1087"
},
{
"name": "CVE-2018-7492",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7492"
},
{
"name": "CVE-2018-14634",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14634"
},
{
"name": "CVE-2018-9385",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-9385"
},
{
"name": "CVE-2018-1094",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1094"
},
{
"name": "CVE-2018-13406",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-13406"
},
{
"name": "CVE-2018-8781",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8781"
},
{
"name": "CVE-2017-18241",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18241"
},
{
"name": "CVE-2018-10124",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10124"
},
{
"name": "CVE-2018-13053",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-13053"
},
{
"name": "CVE-2018-5848",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5848"
},
{
"name": "CVE-2018-17182",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17182"
},
{
"name": "CVE-2018-8822",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8822"
},
{
"name": "CVE-2018-1130",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1130"
},
{
"name": "CVE-2017-18249",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18249"
},
{
"name": "CVE-2018-8043",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8043"
},
{
"name": "CVE-2018-10087",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10087"
},
{
"name": "CVE-2018-3620",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3620"
},
{
"name": "CVE-2018-13405",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-13405"
},
{
"name": "CVE-2018-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3639"
},
{
"name": "CVE-2017-18344",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18344"
},
{
"name": "CVE-2018-5803",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5803"
},
{
"name": "CVE-2018-3665",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3665"
},
{
"name": "CVE-2018-5390",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5390"
},
{
"name": "CVE-2017-18257",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18257"
},
{
"name": "CVE-2018-14633",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14633"
},
{
"name": "CVE-2018-8897",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8897"
},
{
"name": "CVE-2018-1093",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1093"
},
{
"name": "CVE-2018-3646",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3646"
},
{
"name": "CVE-2018-1092",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1092"
},
{
"name": "CVE-2018-5814",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5814"
},
{
"name": "CVE-2017-5715",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
},
{
"name": "CVE-2017-13305",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13305"
},
{
"name": "CVE-2018-14734",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14734"
},
{
"name": "CVE-2018-1065",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1065"
},
{
"name": "CVE-2018-7740",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7740"
}
],
"initial_release_date": "2018-10-19T00:00:00",
"last_revision_date": "2018-10-19T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-505",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-10-19T00:00:00.000000"
},
{
"description": "Ajout du bulletin de s\u00e9curit\u00e9 SUSE suse-su-20183238-1 du 18 octobre 2018",
"revision_date": "2018-10-19T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de\nSUSE . Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de SUSE",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20183238-1 du 18 octobre 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183238-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20181571-2 du 18 octobre 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181571-2/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20181855-2 du 18 octobre 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181855-2/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20182344-2 du 18 octobre 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20182344-2/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20181377-2 du 18 octobre 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181377-2/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20181173-2 du 18 octobre 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181173-2/"
}
]
}
CERTFR-2018-AVI-319
Vulnerability from certfr_avis - Published: 2018-07-02 - Updated: 2018-07-02
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE . Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un déni de service et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 11-SP3-LTSS | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 12-SP2-LTSS | ||
| SUSE | SUSE Linux Enterprise Real Time | SUSE Linux Enterprise Real Time Extension 11-SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise Debuginfo 11-SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise Point of Sale 11-SP3 | ||
| SUSE | N/A | OpenStack Cloud Magnum Orchestration 7 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server for SAP 12-SP2 | ||
| SUSE | N/A | SUSE Linux Enterprise Debuginfo 11-SP3 | ||
| SUSE | N/A | SUSE OpenStack Cloud 7 | ||
| SUSE | N/A | SUSE Enterprise Storage 4 | ||
| SUSE | SUSE Linux Enterprise Server | SUSE Linux Enterprise Server 11-EXTRA |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SUSE Linux Enterprise Server 11-SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12-SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time Extension 11-SP4",
"product": {
"name": "SUSE Linux Enterprise Real Time",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Debuginfo 11-SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Point of Sale 11-SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "OpenStack Cloud Magnum Orchestration 7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP 12-SP2",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Debuginfo 11-SP3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE OpenStack Cloud 7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Enterprise Storage 4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 11-EXTRA",
"product": {
"name": "SUSE Linux Enterprise Server",
"vendor": {
"name": "SUSE",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-1000199",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000199"
},
{
"name": "CVE-2018-1000204",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000204"
},
{
"name": "CVE-2018-7492",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7492"
},
{
"name": "CVE-2018-1094",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1094"
},
{
"name": "CVE-2017-18241",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18241"
},
{
"name": "CVE-2018-5848",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5848"
},
{
"name": "CVE-2018-1130",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1130"
},
{
"name": "CVE-2017-18249",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18249"
},
{
"name": "CVE-2018-5803",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5803"
},
{
"name": "CVE-2018-3665",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3665"
},
{
"name": "CVE-2018-1093",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1093"
},
{
"name": "CVE-2018-1092",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1092"
},
{
"name": "CVE-2017-13305",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13305"
},
{
"name": "CVE-2018-1065",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1065"
}
],
"initial_release_date": "2018-07-02T00:00:00",
"last_revision_date": "2018-07-02T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-319",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-07-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de\nSUSE . Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de\ns\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un d\u00e9ni de service et une atteinte\n\u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de SUSE",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20181849-1 du 29 juin 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181849-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20181855-1 du 29 juin 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181855-1/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20181846-1 du 29 juin 2018",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181846-1/"
}
]
}
CNVD-2018-05068
Vulnerability from cnvd - Published: 2018-03-13
VLAI Severity ?
Title
Linux kernel拒绝服务漏洞（CNVD-2018-05068）
Description
Linux kernel是美国Linux基金会发布的操作系统Linux所使用的内核。netfilter subsystem是其中的一个tcp网络包过滤子系统。
Linux kernel 4.15.7及之前版本中的netfilter子系统存在安全漏洞。本地攻击者可利用该漏洞造成拒绝服务（空指针逆向引用）。
Severity
低
Patch Name
Linux kernel拒绝服务漏洞（CNVD-2018-05068）的补丁
Patch Description
Linux kernel是美国Linux基金会发布的操作系统Linux所使用的内核。netfilter subsystem是其中的一个tcp网络包过滤子系统。
Linux kernel 4.15.7及之前版本中的netfilter子系统存在安全漏洞。本地攻击者可利用该漏洞造成拒绝服务（空指针逆向引用）。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布漏洞修复程序，请及时关注更新： https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8
Reference
https://nvd.nist.gov/vuln/detail/CVE-2018-1065
Impacted products
| Name | Linux kernel <=4.15.7 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2018-1065"
}
},
"description": "Linux kernel\u662f\u7f8e\u56fdLinux\u57fa\u91d1\u4f1a\u53d1\u5e03\u7684\u64cd\u4f5c\u7cfb\u7edfLinux\u6240\u4f7f\u7528\u7684\u5185\u6838\u3002netfilter subsystem\u662f\u5176\u4e2d\u7684\u4e00\u4e2atcp\u7f51\u7edc\u5305\u8fc7\u6ee4\u5b50\u7cfb\u7edf\u3002\r\n\r\nLinux kernel 4.15.7\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684netfilter\u5b50\u7cfb\u7edf\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u7a7a\u6307\u9488\u9006\u5411\u5f15\u7528\uff09\u3002",
"discovererName": "Sam Fowler",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2018-05068",
"openTime": "2018-03-13",
"patchDescription": "Linux kernel\u662f\u7f8e\u56fdLinux\u57fa\u91d1\u4f1a\u53d1\u5e03\u7684\u64cd\u4f5c\u7cfb\u7edfLinux\u6240\u4f7f\u7528\u7684\u5185\u6838\u3002netfilter subsystem\u662f\u5176\u4e2d\u7684\u4e00\u4e2atcp\u7f51\u7edc\u5305\u8fc7\u6ee4\u5b50\u7cfb\u7edf\u3002\r\n\r\nLinux kernel 4.15.7\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684netfilter\u5b50\u7cfb\u7edf\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u7a7a\u6307\u9488\u9006\u5411\u5f15\u7528\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Linux kernel\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2018-05068\uff09\u7684\u8865\u4e01",
"products": {
"product": "Linux kernel \u003c=4.15.7"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-1065",
"serverity": "\u4f4e",
"submitTime": "2018-03-02",
"title": "Linux kernel\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2018-05068\uff09"
}
GHSA-CVP9-XF77-46MC
Vulnerability from github – Published: 2022-05-14 02:03 – Updated: 2022-05-14 02:03
VLAI?
Details
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
Severity ?
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-1065"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-02T08:29:00Z",
"severity": "MODERATE"
},
"details": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.",
"id": "GHSA-cvp9-xf77-46mc",
"modified": "2022-05-14T02:03:24Z",
"published": "2022-05-14T02:03:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1065"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2018-1065"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3654-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3654-2"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3656-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4188"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"type": "WEB",
"url": "http://lists.openwall.net/netdev/2018/01/27/46"
},
{
"type": "WEB",
"url": "http://patchwork.ozlabs.org/patch/870355"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040446"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2018-1065
Vulnerability from fkie_nvd - Published: 2018-03-02 08:29 - Updated: 2024-11-21 03:59
Severity ?
Summary
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| linux | linux_kernel | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "87875BCC-05C4-4C72-AB6B-5FD9E4E74521",
"versionEndIncluding": "4.15.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c."
},
{
"lang": "es",
"value": "El subsistema netfilter en el kernel de Linux, hasta la versi\u00f3n 4.15.7, gestiona de manera incorrecta el caso de una regla blob que contiene un salto pero carece de una cadena definida por el usuario. Esto permite que usuarios locales provoquen una denegaci\u00f3n de servicio (DoS) aprovechando las capacidades CAP_NET_RAW o CAP_NET_ADMIN, relacionadas con arpt_do_table en net/ipv4/netfilter/arp_tables.c, ipt_do_table en net/ipv4/netfilter/ip_tables.c y ip6t_do_table en net/ipv6/netfilter/ip6_tables.c."
}
],
"id": "CVE-2018-1065",
"lastModified": "2024-11-21T03:59:06.303",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 4.7,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-02T08:29:00.257",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.openwall.net/netdev/2018/01/27/46"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "http://patchwork.ozlabs.org/patch/870355/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040446"
},
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
},
{
"source": "secalert@redhat.com",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"source": "secalert@redhat.com",
"url": "https://usn.ubuntu.com/3654-1/"
},
{
"source": "secalert@redhat.com",
"url": "https://usn.ubuntu.com/3654-2/"
},
{
"source": "secalert@redhat.com",
"url": "https://usn.ubuntu.com/3656-1/"
},
{
"source": "secalert@redhat.com",
"url": "https://www.debian.org/security/2018/dsa-4188"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.openwall.net/netdev/2018/01/27/46"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "http://patchwork.ozlabs.org/patch/870355/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040446"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/3654-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/3654-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/3656-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.debian.org/security/2018/dsa-4188"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GSD-2018-1065
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2018-1065",
"description": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.",
"id": "GSD-2018-1065",
"references": [
"https://www.suse.com/security/cve/CVE-2018-1065.html",
"https://www.debian.org/security/2018/dsa-4188",
"https://access.redhat.com/errata/RHSA-2018:2948",
"https://ubuntu.com/security/CVE-2018-1065",
"https://advisories.mageia.org/CVE-2018-1065.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2018-1065"
],
"details": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.",
"id": "GSD-2018-1065",
"modified": "2023-12-13T01:22:37.081829Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2018-1065",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Linux kernel 4.15.0-rc9",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "Linux kernel 4.15.0-rc9"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "NULL pointer dereference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://access.redhat.com/errata/RHSA-2018:2948",
"refsource": "MISC",
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
},
{
"name": "https://www.debian.org/security/2018/dsa-4188",
"refsource": "MISC",
"url": "https://www.debian.org/security/2018/dsa-4188"
},
{
"name": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8",
"refsource": "MISC",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"name": "http://lists.openwall.net/netdev/2018/01/27/46",
"refsource": "MISC",
"url": "http://lists.openwall.net/netdev/2018/01/27/46"
},
{
"name": "http://patchwork.ozlabs.org/patch/870355/",
"refsource": "MISC",
"url": "http://patchwork.ozlabs.org/patch/870355/"
},
{
"name": "http://www.securitytracker.com/id/1040446",
"refsource": "MISC",
"url": "http://www.securitytracker.com/id/1040446"
},
{
"name": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8",
"refsource": "MISC",
"url": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"name": "https://usn.ubuntu.com/3654-1/",
"refsource": "MISC",
"url": "https://usn.ubuntu.com/3654-1/"
},
{
"name": "https://usn.ubuntu.com/3654-2/",
"refsource": "MISC",
"url": "https://usn.ubuntu.com/3654-2/"
},
{
"name": "https://usn.ubuntu.com/3656-1/",
"refsource": "MISC",
"url": "https://usn.ubuntu.com/3656-1/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.15.7",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2018-1065"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547824"
},
{
"name": "http://patchwork.ozlabs.org/patch/870355/",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "http://patchwork.ozlabs.org/patch/870355/"
},
{
"name": "http://lists.openwall.net/netdev/2018/01/27/46",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.openwall.net/netdev/2018/01/27/46"
},
{
"name": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8",
"refsource": "MISC",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8"
},
{
"name": "1040446",
"refsource": "SECTRACK",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040446"
},
{
"name": "DSA-4188",
"refsource": "DEBIAN",
"tags": [],
"url": "https://www.debian.org/security/2018/dsa-4188"
},
{
"name": "USN-3654-2",
"refsource": "UBUNTU",
"tags": [],
"url": "https://usn.ubuntu.com/3654-2/"
},
{
"name": "USN-3654-1",
"refsource": "UBUNTU",
"tags": [],
"url": "https://usn.ubuntu.com/3654-1/"
},
{
"name": "USN-3656-1",
"refsource": "UBUNTU",
"tags": [],
"url": "https://usn.ubuntu.com/3656-1/"
},
{
"name": "RHSA-2018:2948",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 4.7,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-02-13T04:53Z",
"publishedDate": "2018-03-02T08:29Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…