SUSE-SU-2016:2674-1

Source
https://www.suse.com/support/update/announcement/2016/suse-su-20162674-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:2674-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2016:2674-1
Related
Published
2016-10-31T06:42:49Z
Modified
2016-10-31T06:42:49Z
Summary
Security update for Linux Kernel Live Patch 8 for SLE 12 SP1
Details

This update for the Linux Kernel 3.12.62-60648 fixes several issues.

The following security bugs were fixed: - CVE-2016-8666: The IP stack in the Linux kernel allowed remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039 (bsc#1001487). - CVE-2016-6480: Race condition in the ioctlsendfib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a 'double fetch' vulnerability (bsc#991667).

References

Affected packages

SUSE:Linux Enterprise Live Patching 12 / kgraft-patch-SLE12-SP1_Update_8

Package

Name
kgraft-patch-SLE12-SP1_Update_8
Purl
purl:rpm/suse/kgraft-patch-SLE12-SP1_Update_8&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2-2.1

Ecosystem specific

{
    "binaries": [
        {
            "kgraft-patch-3_12_62-60_64_8-default": "2-2.1",
            "kgraft-patch-3_12_62-60_64_8-xen": "2-2.1"
        }
    ]
}