| Description: | Summary:
The remote host is missing an update for the 'Linux Kernel (Live Patch 17 for SLE 12 SP2)' package(s) announced via the SUSE-SU-2018:2860-1 advisory.
Vulnerability Insight:
This update for the Linux Kernel 4.4.103-92_56 fixes several issues.
The following security issues were fixed:
CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue()
and tcp_prune_ofo_queue() for every incoming TCP packet which can lead
to a denial of service (bsc#1102682).
CVE-2018-1000026: Fixed an insufficient input validation in bnx2x
network card driver that can result in DoS via very large, specially
crafted packet to the bnx2x card due to a network card firmware
assertion that will take the card offline (bsc#1096723).
CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function
leading to a denial-of-service via crafted network packets (bsc#1106191).
CVE-2018-10902: It was found that the raw midi kernel driver did not
protect against concurrent access which lead to a double realloc (double
free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(),
allowing a malicious local attacker to use this for privilege escalation
(bsc#1105323).
Affected Software/OS:
'Linux Kernel (Live Patch 17 for SLE 12 SP2)' package(s) on SUSE Linux Enterprise Server 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP2.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
