Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2013-4343
Vulnerability from cvelistv5
Published
2013-09-25 10:00
Modified
2024-08-06 16:38
Severity ?
EPSS score ?
Summary
Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:38:01.983Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[netdev] 20130911 Use-after-free in TUNSETIFF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.spinics.net/lists/netdev/msg250066.html"
},
{
"name": "RHSA-2013:1490",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1490.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733"
},
{
"name": "USN-2020-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2020-1"
},
{
"name": "[linux-kernel] 20130911 [PATCH net V2] tuntap: correctly handle error in tun_set_iff()",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2"
},
{
"name": "[oss-security] 20130912 Fwd: Use-after-free in TUNSETIFF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/09/12/3"
},
{
"name": "USN-2049-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2049-1"
},
{
"name": "USN-2023-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2023-1"
},
{
"name": "openSUSE-SU-2019:1479",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html"
},
{
"name": "openSUSE-SU-2019:1570",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html"
},
{
"name": "openSUSE-SU-2019:1579",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-09-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-18T23:06:04",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[netdev] 20130911 Use-after-free in TUNSETIFF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.spinics.net/lists/netdev/msg250066.html"
},
{
"name": "RHSA-2013:1490",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1490.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733"
},
{
"name": "USN-2020-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2020-1"
},
{
"name": "[linux-kernel] 20130911 [PATCH net V2] tuntap: correctly handle error in tun_set_iff()",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2"
},
{
"name": "[oss-security] 20130912 Fwd: Use-after-free in TUNSETIFF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/09/12/3"
},
{
"name": "USN-2049-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2049-1"
},
{
"name": "USN-2023-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2023-1"
},
{
"name": "openSUSE-SU-2019:1479",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html"
},
{
"name": "openSUSE-SU-2019:1570",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html"
},
{
"name": "openSUSE-SU-2019:1579",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4343",
"datePublished": "2013-09-25T10:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:38:01.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2013-4343\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2013-09-25T10:31:29.207\",\"lastModified\":\"2024-11-21T01:55:23.393\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de uso despues de liberaci\u00f3n en drivers/net/tun.c en el kernel Linux 3.11.1 permite a usuarios locales obtener privilegios aprovechado CAP_NET_ADMIN e introduciendo un nombre de interfaz tuntap inv\u00e1lido en una llamada TUNSETIFF ioctl.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":6.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-399\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.8\",\"versionEndExcluding\":\"3.10.16\",\"matchCriteriaId\":\"DBBFD2F4-C6E2-42BA-94F5-B05D23189DA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.11\",\"versionEndExcluding\":\"3.11.5\",\"matchCriteriaId\":\"0313FEE8-9C18-417D-8600-CC657696FB8B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFAA48D9-BEB4-4E49-AD50-325C262D46D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F61F047-129C-41A6-8A27-FFCBB8563E91\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1490.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/09/12/3\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.spinics.net/lists/netdev/msg250066.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2020-1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2023-1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2049-1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1007733\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1490.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/09/12/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.spinics.net/lists/netdev/msg250066.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2020-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2023-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2049-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1007733\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]}]}}"
}
}
ghsa-p6h8-8fv7-v27h
Vulnerability from github
Published
2022-05-14 00:59
Modified
2022-05-14 00:59
Details
Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.
{
"affected": [],
"aliases": [
"CVE-2013-4343"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-09-25T10:31:00Z",
"severity": "MODERATE"
},
"details": "Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.",
"id": "GHSA-p6h8-8fv7-v27h",
"modified": "2022-05-14T00:59:51Z",
"published": "2022-05-14T00:59:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4343"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2013-4343"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1490.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/09/12/3"
},
{
"type": "WEB",
"url": "http://www.spinics.net/lists/netdev/msg250066.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2020-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2023-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2049-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
gsd-2013-4343
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2013-4343",
"description": "Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.",
"id": "GSD-2013-4343",
"references": [
"https://www.suse.com/security/cve/CVE-2013-4343.html",
"https://access.redhat.com/errata/RHSA-2013:1490"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2013-4343"
],
"details": "Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.",
"id": "GSD-2013-4343",
"modified": "2023-12-13T01:22:15.869561Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-4343",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html",
"refsource": "MISC",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html"
},
{
"name": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html",
"refsource": "MISC",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html"
},
{
"name": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html",
"refsource": "MISC",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html"
},
{
"name": "http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2",
"refsource": "MISC",
"url": "http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2013-1490.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1490.html"
},
{
"name": "http://www.openwall.com/lists/oss-security/2013/09/12/3",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2013/09/12/3"
},
{
"name": "http://www.spinics.net/lists/netdev/msg250066.html",
"refsource": "MISC",
"url": "http://www.spinics.net/lists/netdev/msg250066.html"
},
{
"name": "http://www.ubuntu.com/usn/USN-2020-1",
"refsource": "MISC",
"url": "http://www.ubuntu.com/usn/USN-2020-1"
},
{
"name": "http://www.ubuntu.com/usn/USN-2023-1",
"refsource": "MISC",
"url": "http://www.ubuntu.com/usn/USN-2023-1"
},
{
"name": "http://www.ubuntu.com/usn/USN-2049-1",
"refsource": "MISC",
"url": "http://www.ubuntu.com/usn/USN-2049-1"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.10.16",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.11.5",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-4343"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733"
},
{
"name": "[oss-security] 20130912 Fwd: Use-after-free in TUNSETIFF",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/09/12/3"
},
{
"name": "[linux-kernel] 20130911 [PATCH net V2] tuntap: correctly handle error in tun_set_iff()",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://marc.info/?l=linux-kernel\u0026m=137889490510745\u0026w=2"
},
{
"name": "[netdev] 20130911 Use-after-free in TUNSETIFF",
"refsource": "MLIST",
"tags": [
"Third Party Advisory"
],
"url": "http://www.spinics.net/lists/netdev/msg250066.html"
},
{
"name": "USN-2049-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2049-1"
},
{
"name": "RHSA-2013:1490",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1490.html"
},
{
"name": "USN-2023-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2023-1"
},
{
"name": "USN-2020-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2020-1"
},
{
"name": "openSUSE-SU-2019:1479",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html"
},
{
"name": "openSUSE-SU-2019:1570",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html"
},
{
"name": "openSUSE-SU-2019:1579",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2023-08-11T18:13Z",
"publishedDate": "2013-09-25T10:31Z"
}
}
}
rhsa-2013_1490
Vulnerability from csaf_redhat
Published
2013-10-31 16:21
Modified
2024-11-22 07:43
Summary
Red Hat Security Advisory: kernel-rt security and bug fix update
Notes
Topic
Updated kernel-rt packages that fix multiple security issues and one bug
are now available for Red Hat Enterprise MRG 2.4.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.
* A flaw was found in the way IP packets with an Internet Header Length
(ihl) of zero were processed in the skb_flow_dissect() function in the
Linux kernel. A remote attacker could use this flaw to trigger an infinite
loop in the kernel, leading to a denial of service. (CVE-2013-4348,
Important)
* A flaw was found in the way the Linux kernel's IPv6 implementation
handled certain UDP packets when the UDP Fragmentation Offload (UFO)
feature was enabled. A remote attacker could use this flaw to crash the
system or, potentially, escalate their privileges on the system.
(CVE-2013-4387, Important)
* A flaw was found in the way the Linux kernel handled the creation of
temporary IPv6 addresses. If the IPv6 privacy extension was enabled
(/proc/sys/net/ipv6/conf/eth0/use_tempaddr set to '2'), an attacker on
the local network could disable IPv6 temporary address generation, leading
to a potential information disclosure. (CVE-2013-0343, Moderate)
* A flaw was found in the way the Linux kernel handled HID (Human Interface
Device) reports with an out-of-bounds Report ID. An attacker with physical
access to the system could use this flaw to crash the system or,
potentially, escalate their privileges on the system. (CVE-2013-2888,
Moderate)
* Heap-based buffer overflow flaws were found in the way the
Pantherlord/GreenAsia game controller driver, the Logitech force feedback
drivers, and the Logitech Unifying receivers driver handled HID reports.
An attacker with physical access to the system could use these flaws to
crash the system or, potentially, escalate their privileges on the system.
(CVE-2013-2892, CVE-2013-2893, CVE-2013-2895, Moderate)
* A NULL pointer dereference flaw was found in the way the N-Trig touch
screen driver handled HID reports. An attacker with physical access to the
system could use this flaw to crash the system, resulting in a denial of
service. (CVE-2013-2896, Moderate)
* An information leak flaw was found in the way the Linux kernel's device
mapper subsystem, under certain conditions, interpreted data written to
snapshot block devices. An attacker could use this flaw to read data from
disk blocks in free space, which are normally inaccessible. (CVE-2013-4299,
Moderate)
* A use-after-free flaw was found in the tun_set_iff() function in the
Universal TUN/TAP device driver implementation in the Linux kernel.
A privileged user could use this flaw to crash the system or, potentially,
further escalate their privileges on the system. (CVE-2013-4343, Moderate)
* An off-by-one flaw was found in the way the ANSI CPRNG implementation in
the Linux kernel processed non-block size aligned requests. This could lead
to random numbers being generated with less bits of entropy than expected
when ANSI CPRNG was used. (CVE-2013-4345, Moderate)
* A flaw was found in the way the Linux kernel's IPv6 SCTP implementation
interacted with the IPsec subsystem. This resulted in unencrypted SCTP
packets being sent over the network even though IPsec encryption was
enabled. An attacker able to inspect these SCTP packets could use this flaw
to obtain potentially sensitive information. (CVE-2013-4350, Moderate)
Red Hat would like to thank Fujitsu for reporting CVE-2013-4299 and Stephan
Mueller for reporting CVE-2013-4345. The CVE-2013-4348 issue was discovered
by Jason Wang of Red Hat.
Bug fix:
* RoCE appeared to be supported in the MRG Realtime kernel even when the
required user space packages from the HPN channel were not installed.
The Realtime kernel now checks for the HPN channel packages before exposing
the RoCE interfaces. RoCE devices appear as plain 10GigE devices if the
needed HPN channel user space packages are not installed. (BZ#1012993)
Users should upgrade to these updated packages, which upgrade the kernel-rt
kernel to version kernel-rt-3.8.13-rt14, and correct these issues.
The system must be rebooted for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated kernel-rt packages that fix multiple security issues and one bug\nare now available for Red Hat Enterprise MRG 2.4.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The kernel-rt packages contain the Linux kernel, the core of any Linux\noperating system.\n\n* A flaw was found in the way IP packets with an Internet Header Length\n(ihl) of zero were processed in the skb_flow_dissect() function in the\nLinux kernel. A remote attacker could use this flaw to trigger an infinite\nloop in the kernel, leading to a denial of service. (CVE-2013-4348,\nImportant)\n\n* A flaw was found in the way the Linux kernel\u0027s IPv6 implementation\nhandled certain UDP packets when the UDP Fragmentation Offload (UFO)\nfeature was enabled. A remote attacker could use this flaw to crash the\nsystem or, potentially, escalate their privileges on the system.\n(CVE-2013-4387, Important)\n\n* A flaw was found in the way the Linux kernel handled the creation of\ntemporary IPv6 addresses. If the IPv6 privacy extension was enabled\n(/proc/sys/net/ipv6/conf/eth0/use_tempaddr set to \u00272\u0027), an attacker on\nthe local network could disable IPv6 temporary address generation, leading\nto a potential information disclosure. (CVE-2013-0343, Moderate)\n\n* A flaw was found in the way the Linux kernel handled HID (Human Interface\nDevice) reports with an out-of-bounds Report ID. An attacker with physical\naccess to the system could use this flaw to crash the system or,\npotentially, escalate their privileges on the system. (CVE-2013-2888,\nModerate)\n\n* Heap-based buffer overflow flaws were found in the way the\nPantherlord/GreenAsia game controller driver, the Logitech force feedback\ndrivers, and the Logitech Unifying receivers driver handled HID reports.\nAn attacker with physical access to the system could use these flaws to\ncrash the system or, potentially, escalate their privileges on the system.\n(CVE-2013-2892, CVE-2013-2893, CVE-2013-2895, Moderate)\n\n* A NULL pointer dereference flaw was found in the way the N-Trig touch\nscreen driver handled HID reports. An attacker with physical access to the\nsystem could use this flaw to crash the system, resulting in a denial of\nservice. (CVE-2013-2896, Moderate)\n\n* An information leak flaw was found in the way the Linux kernel\u0027s device\nmapper subsystem, under certain conditions, interpreted data written to\nsnapshot block devices. An attacker could use this flaw to read data from\ndisk blocks in free space, which are normally inaccessible. (CVE-2013-4299,\nModerate)\n\n* A use-after-free flaw was found in the tun_set_iff() function in the\nUniversal TUN/TAP device driver implementation in the Linux kernel.\nA privileged user could use this flaw to crash the system or, potentially,\nfurther escalate their privileges on the system. (CVE-2013-4343, Moderate)\n\n* An off-by-one flaw was found in the way the ANSI CPRNG implementation in\nthe Linux kernel processed non-block size aligned requests. This could lead\nto random numbers being generated with less bits of entropy than expected\nwhen ANSI CPRNG was used. (CVE-2013-4345, Moderate)\n\n* A flaw was found in the way the Linux kernel\u0027s IPv6 SCTP implementation\ninteracted with the IPsec subsystem. This resulted in unencrypted SCTP\npackets being sent over the network even though IPsec encryption was\nenabled. An attacker able to inspect these SCTP packets could use this flaw\nto obtain potentially sensitive information. (CVE-2013-4350, Moderate)\n\nRed Hat would like to thank Fujitsu for reporting CVE-2013-4299 and Stephan\nMueller for reporting CVE-2013-4345. The CVE-2013-4348 issue was discovered\nby Jason Wang of Red Hat.\n\nBug fix:\n\n* RoCE appeared to be supported in the MRG Realtime kernel even when the\nrequired user space packages from the HPN channel were not installed.\nThe Realtime kernel now checks for the HPN channel packages before exposing\nthe RoCE interfaces. RoCE devices appear as plain 10GigE devices if the\nneeded HPN channel user space packages are not installed. (BZ#1012993)\n\nUsers should upgrade to these updated packages, which upgrade the kernel-rt\nkernel to version kernel-rt-3.8.13-rt14, and correct these issues.\nThe system must be rebooted for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:1490",
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "914664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914664"
},
{
"category": "external",
"summary": "1000360",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000360"
},
{
"category": "external",
"summary": "1000414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000414"
},
{
"category": "external",
"summary": "1000429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000429"
},
{
"category": "external",
"summary": "1000451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000451"
},
{
"category": "external",
"summary": "1000494",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000494"
},
{
"category": "external",
"summary": "1004233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1004233"
},
{
"category": "external",
"summary": "1007690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007690"
},
{
"category": "external",
"summary": "1007733",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733"
},
{
"category": "external",
"summary": "1007872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007872"
},
{
"category": "external",
"summary": "1007939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007939"
},
{
"category": "external",
"summary": "1011927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1011927"
},
{
"category": "external",
"summary": "1012993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1012993"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1490.json"
}
],
"title": "Red Hat Security Advisory: kernel-rt security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T07:43:43+00:00",
"generator": {
"date": "2024-11-22T07:43:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:1490",
"initial_release_date": "2013-10-31T16:21:00+00:00",
"revision_history": [
{
"date": "2013-10-31T16:21:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-10-31T16:23:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:43:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat MRG Realtime for RHEL 6 Server v.2",
"product": {
"name": "Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise MRG for RHEL-6"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-vanilla@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-vanilla-devel@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-trace@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-trace-debuginfo@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-vanilla-debuginfo@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debuginfo@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-devel@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-trace-devel@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product": {
"name": "kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_id": "kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-devel@3.8.13-rt14.25.el6rt?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"product": {
"name": "kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"product_id": "kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt@3.8.13-rt14.25.el6rt?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"product": {
"name": "kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"product_id": "kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-firmware@3.8.13-rt14.25.el6rt?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"product": {
"name": "kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"product_id": "kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-doc@3.8.13-rt14.25.el6rt?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch",
"product": {
"name": "mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch",
"product_id": "mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mrg-rt-release@3.8.13-rt14.25.el6rt?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-0:3.8.13-rt14.25.el6rt.src as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src"
},
"product_reference": "kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch"
},
"product_reference": "kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch"
},
"product_reference": "kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64"
},
"product_reference": "kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
"product_id": "6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
},
"product_reference": "mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch",
"relates_to_product_reference": "6Server-MRG-Realtime-2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-0343",
"discovery_date": "2012-11-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "914664"
}
],
"notes": [
{
"category": "description",
"text": "The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: handling of IPv6 temporary addresses",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0343"
},
{
"category": "external",
"summary": "RHBZ#914664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0343",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0343"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0343",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0343"
}
],
"release_date": "2012-11-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.2,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: handling of IPv6 temporary addresses"
},
{
"cve": "CVE-2013-2888",
"discovery_date": "2013-08-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1000451"
}
],
"notes": [
{
"category": "description",
"text": "Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Kernel: HID: memory corruption flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.\n\nNote: user would need physical access to the system to exploit this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2888"
},
{
"category": "external",
"summary": "RHBZ#1000451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000451"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2888",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2888"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2888",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2888"
}
],
"release_date": "2013-08-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Kernel: HID: memory corruption flaw"
},
{
"cve": "CVE-2013-2892",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2013-08-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1000429"
}
],
"notes": [
{
"category": "description",
"text": "drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Kernel: HID: pantherlord: heap overflow flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5.\n\nThis issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this issue.\n\nNote: user would need physical access to the system to exploit this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2892"
},
{
"category": "external",
"summary": "RHBZ#1000429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2892",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2892"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2892",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2892"
}
],
"release_date": "2013-08-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Kernel: HID: pantherlord: heap overflow flaw"
},
{
"cve": "CVE-2013-2893",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2013-08-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1000414"
}
],
"notes": [
{
"category": "description",
"text": "The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Kernel: HID: LG: heap overflow flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.\n\nThis issue affects the version of the kernel package as shipped with Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.\n\nNote: user would need physical access to the system to exploit this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2893"
},
{
"category": "external",
"summary": "RHBZ#1000414",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000414"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2893",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2893"
}
],
"release_date": "2013-08-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Kernel: HID: LG: heap overflow flaw"
},
{
"cve": "CVE-2013-2895",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2013-08-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1000360"
}
],
"notes": [
{
"category": "description",
"text": "drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Kernel: HID: logitech-dj: heap overflow flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.\n\nThis issue affects the version of the kernel package as shipped with Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.\n\nNote: user would need physical access to the system to exploit this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2895"
},
{
"category": "external",
"summary": "RHBZ#1000360",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000360"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2895",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2895"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2895",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2895"
}
],
"release_date": "2013-08-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Kernel: HID: logitech-dj: heap overflow flaw"
},
{
"cve": "CVE-2013-2896",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2013-08-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1000494"
}
],
"notes": [
{
"category": "description",
"text": "drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Kernel: HID: ntrig: NULL pointer dereference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.\n\nThis issue affects the version of the kernel package as shipped with Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.\n\nNote: user would need physical access to the system to exploit this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2896"
},
{
"category": "external",
"summary": "RHBZ#1000494",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000494"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2896",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2896"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2896",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2896"
}
],
"release_date": "2013-08-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:H/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Kernel: HID: ntrig: NULL pointer dereference"
},
{
"acknowledgments": [
{
"names": [
"Fujitsu"
]
}
],
"cve": "CVE-2013-4299",
"discovery_date": "2013-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1004233"
}
],
"notes": [
{
"category": "description",
"text": "Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: dm: dm-snapshot data leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4299"
},
{
"category": "external",
"summary": "RHBZ#1004233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1004233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4299",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4299"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4299",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4299"
}
],
"release_date": "2013-10-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: dm: dm-snapshot data leak"
},
{
"cve": "CVE-2013-4343",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2013-09-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1007733"
}
],
"notes": [
{
"category": "description",
"text": "Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Kernel: net: use-after-free TUNSETIFF",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4343"
},
{
"category": "external",
"summary": "RHBZ#1007733",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007733"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4343",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4343"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4343",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4343"
}
],
"release_date": "2013-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Kernel: net: use-after-free TUNSETIFF"
},
{
"acknowledgments": [
{
"names": [
"Stephan Mueller"
]
}
],
"cve": "CVE-2013-4345",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"discovery_date": "2013-09-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1007690"
}
],
"notes": [
{
"category": "description",
"text": "Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple requests for small amounts of data, leading to improper management of the state of the consumed data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: ansi_cprng: off by one error in non-block size request",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2 may address this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4345"
},
{
"category": "external",
"summary": "RHBZ#1007690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4345",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4345"
}
],
"release_date": "2013-09-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: ansi_cprng: off by one error in non-block size request"
},
{
"acknowledgments": [
{
"names": [
"Jason Wang"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-4348",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2013-09-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1007939"
}
],
"notes": [
{
"category": "description",
"text": "The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with IPIP encapsulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: net: deadloop path in skb_flow_dissect()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6. Future Linux kernel updates for Red Hat Enterprise Linux MRG 2 might address this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4348"
},
{
"category": "external",
"summary": "RHBZ#1007939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4348",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4348"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4348",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4348"
}
],
"release_date": "2013-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: net: deadloop path in skb_flow_dissect()"
},
{
"cve": "CVE-2013-4350",
"discovery_date": "2013-09-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1007872"
}
],
"notes": [
{
"category": "description",
"text": "The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: net: sctp: ipv6 ipsec encryption bug in sctp_v6_xmit",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The risks associated with fixing this bug in Red Hat Enterprise Linux 5 and 6 are greater than its security impact. This issue is not currently planned to be addressed in future kernel updates for Red Hat Enterprise Linux 5 and 6.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4350"
},
{
"category": "external",
"summary": "RHBZ#1007872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007872"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4350",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4350"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4350",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4350"
}
],
"release_date": "2010-12-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: net: sctp: ipv6 ipsec encryption bug in sctp_v6_xmit"
},
{
"cve": "CVE-2013-4387",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2013-09-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1011927"
}
],
"notes": [
{
"category": "description",
"text": "net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Kernel: net: IPv6: panic when UFO=On for an interface",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5.\n\nThis issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4387"
},
{
"category": "external",
"summary": "RHBZ#1011927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1011927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4387",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4387"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4387",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4387"
}
],
"release_date": "2013-09-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-10-31T16:21:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not use\n\"rpm -Uvh\" as that will remove the running kernel binaries from your\nsystem. You may use \"rpm -e\" to remove old kernels after determining that\nthe new kernel functions properly on your system.",
"product_ids": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1490"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"products": [
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.src",
"6Server-MRG-Realtime-2:kernel-rt-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-doc-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.8.13-rt14.25.el6rt.noarch",
"6Server-MRG-Realtime-2:kernel-rt-trace-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.8.13-rt14.25.el6rt.x86_64",
"6Server-MRG-Realtime-2:mrg-rt-release-0:3.8.13-rt14.25.el6rt.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Kernel: net: IPv6: panic when UFO=On for an interface"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.