USN-3381-1

Description

linux vulnerabilities Peter Pi discovered that the colormap handling for frame buffer devices in the Linux kernel contained an integer overflow. A local attacker could use this to disclose sensitive information (kernel memory). (CVE-2016-8405) It was discovered that the Linux kernel did not properly restrict RLIMIT_STACK size. A local attacker could use this in conjunction with another vulnerability to possibly execute arbitrary code. (CVE-2017-1000365) It was discovered that SELinux in the Linux kernel did not properly handle empty writes to /proc/pid/attr. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-2618) 石磊 discovered that the RxRPC Kerberos 5 ticket handling code in the Linux kernel did not properly verify metadata. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-7482)

Affected Systems

• ubuntu•linux

  < 3.13.0-126.175

References (5)

• https://ubuntu.com/security/notices/USN-3381-1
• https://ubuntu.com/security/CVE-2016-8405
• https://ubuntu.com/security/CVE-2017-2618
• https://ubuntu.com/security/CVE-2017-7482
• https://ubuntu.com/security/CVE-2017-1000365