Vulnerability-Lookup

CVE-2020-15436 (GCVE-0-2020-15436)

Vulnerability from cvelistv5 – Published: 2020-11-23 20:08 – Updated: 2024-08-04 13:15

Summary

Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

Use After Free

Assigner

openEuler

References

2 references

URL	Tags
https://lkml.org/lkml/2020/6/7/379	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2020121…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	linux kernel	Affected: 5.7 (verified), possibly others 4.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:15:20.795Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lkml.org/lkml/2020/6/7/379"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201218-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "linux kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "5.7 (verified), possibly others 4.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use After Free",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-18T10:06:18.000Z",
        "orgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2",
        "shortName": "openEuler"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lkml.org/lkml/2020/6/7/379"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201218-0002/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "securities@openeuler.org",
          "ID": "CVE-2020-15436",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "linux kernel",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "5.7 (verified), possibly others 4.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use After Free"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lkml.org/lkml/2020/6/7/379",
              "refsource": "MISC",
              "url": "https://lkml.org/lkml/2020/6/7/379"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201218-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201218-0002/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2",
    "assignerShortName": "openEuler",
    "cveId": "CVE-2020-15436",
    "datePublished": "2020-11-23T20:08:17.000Z",
    "dateReserved": "2020-06-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:15:20.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-15436",
      "date": "2026-06-24",
      "epss": "0.00928",
      "percentile": "0.5592"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.6.38\", \"versionEndExcluding\": \"4.4.229\", \"matchCriteriaId\": \"DA9AE6DE-39FB-4119-AD8F-03D9E12D699F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.5\", \"versionEndExcluding\": \"4.9.229\", \"matchCriteriaId\": \"9C7D30FF-7984-4EB3-AF8A-0E29064F16AC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.10\", \"versionEndExcluding\": \"4.14.186\", \"matchCriteriaId\": \"AE916088-825A-4296-BD7D-7016A72F957A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.15\", \"versionEndExcluding\": \"4.19.130\", \"matchCriteriaId\": \"D43D9AB3-E226-4A4C-963C-2B77834AD8EC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.49\", \"matchCriteriaId\": \"D0D47E73-D50E-4A82-B7B9-26452AD64BBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.7.6\", \"matchCriteriaId\": \"1D2A3E90-AD7E-4224-926C-E4B10ABFE1DB\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2748912-FC54-47F6-8C0C-B96784765B8E\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5C2089EE-5D7F-47EC-8EA5-0F69790564C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:solidfire_\\\\\u0026_hci_management_node:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D6D700C5-F67F-4FFB-BE69-D524592A3D2E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FB9B8171-F6CA-427D-81E0-6536D3BBFA8D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"090AA6F4-4404-4E26-82AB-C3A22636F276\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CDDF61B7-EC5C-467C-B710-B89F502CD04F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"89612649-BACF-4FAC-9BA4-324724FD93A6\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F3D9B255-C1AF-42D1-BF9B-13642FBDC080\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD7CFE0E-9D1E-4495-B302-89C3096FC0DF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F63A3FA7-AAED-4A9D-9FDE-6195302DA0F6\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5921A877-18BF-43FE-915C-D226E140ACFC\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7296A1F2-D315-4FD5-8A73-65C480C855BE\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FDD92BFA-9117-4E6E-A13F-ED064B4B7284\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4B7DA42F-5D64-4967-A2D4-6210FE507841\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"70ECC434-DF20-49A6-B4CF-D5CCA480E57D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"232DC609-8023-41F9-8CE3-1B31CE2F2D93\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF5AFE69-7990-4F80-9E63-D8AD58AA3A2D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6415E28A-4EAC-4F7F-BD81-1A55CE8B6F40\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA79D39A-A5F2-4C44-A805-5113065F8C25\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4CA55FBD-6EBA-49C8-92BA-2B1BCCB18A3A\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D5CDADAB-72A5-4526-8432-E6C9AC56B29F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E64576DE-90F0-4F5E-9C82-AB745CFEDBB7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56FD9B9A-BBE5-4CA5-B9F9-B16E1FE738C8\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F3E70A56-DBA8-45C7-8C49-1A036501156F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0BA5679F-B7F4-482B-92B3-52121124829F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"02F063AC-FC82-45E4-A977-243FB3569904\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1236B66D-EB11-4324-929F-E2B86683C3C7\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"281DFC67-46BB-4FC2-BE03-3C65C9311F65\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"578BB9A7-BF28-4068-A9A6-1DE19CEEC293\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AB58180-E5E0-4056-ABF9-A99E9F6A9E86\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"86E430A7-F93D-422B-BC9E-99C17CC2BF6F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DBC58E3E-C8AA-4400-8A48-733B321CC924\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.\"}, {\"lang\": \"es\", \"value\": \"La vulnerabilidad de tipo use-after-free en el archivo fs/block_dev.c en el kernel de Linux versiones anteriores a 5.8, permite a usuarios locales obtener privilegios o causar una denegaci\\u00f3n de servicio al aprovechar el acceso inapropiado a un determinado campo de error\"}]",
      "id": "CVE-2020-15436",
      "lastModified": "2024-11-21T05:05:33.167",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 6.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 7.2, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 3.9, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-11-23T21:15:11.813",
      "references": "[{\"url\": \"https://lkml.org/lkml/2020/6/7/379\", \"source\": \"securities@openeuler.org\", \"tags\": [\"Exploit\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201218-0002/\", \"source\": \"securities@openeuler.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lkml.org/lkml/2020/6/7/379\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201218-0002/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "securities@openeuler.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-15436\",\"sourceIdentifier\":\"securities@openeuler.org\",\"published\":\"2020-11-23T21:15:11.813\",\"lastModified\":\"2024-11-21T05:05:33.167\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de tipo use-after-free en el archivo fs/block_dev.c en el kernel de Linux versiones anteriores a 5.8, permite a usuarios locales obtener privilegios o causar una denegaci\u00f3n de servicio al aprovechar el acceso inapropiado a un determinado campo de error\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":7.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":3.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.38\",\"versionEndExcluding\":\"4.4.229\",\"matchCriteriaId\":\"DA9AE6DE-39FB-4119-AD8F-03D9E12D699F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5\",\"versionEndExcluding\":\"4.9.229\",\"matchCriteriaId\":\"9C7D30FF-7984-4EB3-AF8A-0E29064F16AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.186\",\"matchCriteriaId\":\"AE916088-825A-4296-BD7D-7016A72F957A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.130\",\"matchCriteriaId\":\"D43D9AB3-E226-4A4C-963C-2B77834AD8EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.49\",\"matchCriteriaId\":\"D0D47E73-D50E-4A82-B7B9-26452AD64BBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.7.6\",\"matchCriteriaId\":\"1D2A3E90-AD7E-4224-926C-E4B10ABFE1DB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2748912-FC54-47F6-8C0C-B96784765B8E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C2089EE-5D7F-47EC-8EA5-0F69790564C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:solidfire_\\\\\u0026_hci_management_node:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6D700C5-F67F-4FFB-BE69-D524592A3D2E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB9B8171-F6CA-427D-81E0-6536D3BBFA8D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"090AA6F4-4404-4E26-82AB-C3A22636F276\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDDF61B7-EC5C-467C-B710-B89F502CD04F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89612649-BACF-4FAC-9BA4-324724FD93A6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3D9B255-C1AF-42D1-BF9B-13642FBDC080\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD7CFE0E-9D1E-4495-B302-89C3096FC0DF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F63A3FA7-AAED-4A9D-9FDE-6195302DA0F6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5921A877-18BF-43FE-915C-D226E140ACFC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7296A1F2-D315-4FD5-8A73-65C480C855BE\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDD92BFA-9117-4E6E-A13F-ED064B4B7284\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B7DA42F-5D64-4967-A2D4-6210FE507841\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70ECC434-DF20-49A6-B4CF-D5CCA480E57D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"232DC609-8023-41F9-8CE3-1B31CE2F2D93\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF5AFE69-7990-4F80-9E63-D8AD58AA3A2D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6415E28A-4EAC-4F7F-BD81-1A55CE8B6F40\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA79D39A-A5F2-4C44-A805-5113065F8C25\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CA55FBD-6EBA-49C8-92BA-2B1BCCB18A3A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5CDADAB-72A5-4526-8432-E6C9AC56B29F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E64576DE-90F0-4F5E-9C82-AB745CFEDBB7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56FD9B9A-BBE5-4CA5-B9F9-B16E1FE738C8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3E70A56-DBA8-45C7-8C49-1A036501156F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BA5679F-B7F4-482B-92B3-52121124829F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02F063AC-FC82-45E4-A977-243FB3569904\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1236B66D-EB11-4324-929F-E2B86683C3C7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"281DFC67-46BB-4FC2-BE03-3C65C9311F65\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"578BB9A7-BF28-4068-A9A6-1DE19CEEC293\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AB58180-E5E0-4056-ABF9-A99E9F6A9E86\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86E430A7-F93D-422B-BC9E-99C17CC2BF6F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DBC58E3E-C8AA-4400-8A48-733B321CC924\"}]}]}],\"references\":[{\"url\":\"https://lkml.org/lkml/2020/6/7/379\",\"source\":\"securities@openeuler.org\",\"tags\":[\"Exploit\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20201218-0002/\",\"source\":\"securities@openeuler.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lkml.org/lkml/2020/6/7/379\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20201218-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}

CERTFR-2024-AVI-0203

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	Cerberus PRO EN Engineering Tool versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN Fire Panel FC20 versions antérieures à MP8
Siemens	N/A	RUGGEDCOM APE1808 avec Fortinet NGFW versions antérieures à V7.4.1
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions
Siemens	N/A	Sinteso FS20 EN Engineering Tool versions antérieures à MP8
Siemens	N/A	SIMATIC RF160B (6GT2003-0FA00) versions antérieures à V2.2
Siemens	N/A	SINEMA Remote Connect Server versions antérieures à V3.2
Siemens	N/A	Solid Edge versions antérieures à V223.0.11
Siemens	N/A	Siveillance Control versions supérieures ou égales à V2.8 versions antérieures à V3.1.1
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Cerberus PRO EN Fire Panel FC72x versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	SINEMA Remote Connect Client versions antérieures à V3.1 SP1
Siemens	N/A	SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Sinteso Mobile versions antérieures à V3.0.0

References

Title

Publication Time

CNVD-2020-66297

Vulnerability from cnvd - Published: 2020-11-25

Title

Linux kernel释放后重用漏洞

Description

Linux kernel是一种计算机操作系统内核，以C语言和汇编语言写成，符合POSIX标准，按GNU通用公共许可证发行。 Linux kernel5.8之前版本中的fs/block_dev.c存在释放后重用漏洞。该漏洞源于对某错误字段的访问控制不当。本地用户可利用该漏洞获得特权或导致拒绝服务。

Severity

低

Patch Name

Linux kernel释放后重用漏洞的补丁

Patch Description

Linux kernel是一种计算机操作系统内核，以C语言和汇编语言写成，符合POSIX标准，按GNU通用公共许可证发行。 Linux kernel5.8之前版本中的fs/block_dev.c存在释放后重用漏洞。该漏洞源于对某错误字段的访问控制不当。本地用户可利用该漏洞获得特权或导致拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://lkml.org/lkml/2020/6/7/379

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-15436

Impacted products

Name
Linux Linux kernel <5.8

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-15436",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-15436"
    }
  },
  "description": "Linux kernel\u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\uff0c\u4ee5C\u8bed\u8a00\u548c\u6c47\u7f16\u8bed\u8a00\u5199\u6210\uff0c\u7b26\u5408POSIX\u6807\u51c6\uff0c\u6309GNU\u901a\u7528\u516c\u5171\u8bb8\u53ef\u8bc1\u53d1\u884c\u3002\n\nLinux kernel5.8\u4e4b\u524d\u7248\u672c\u4e2d\u7684fs/block_dev.c\u5b58\u5728\u91ca\u653e\u540e\u91cd\u7528\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9\u67d0\u9519\u8bef\u5b57\u6bb5\u7684\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\u3002\u672c\u5730\u7528\u6237\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u5f97\u7279\u6743\u6216\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://lkml.org/lkml/2020/6/7/379",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-66297",
  "openTime": "2020-11-25",
  "patchDescription": "Linux kernel\u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\uff0c\u4ee5C\u8bed\u8a00\u548c\u6c47\u7f16\u8bed\u8a00\u5199\u6210\uff0c\u7b26\u5408POSIX\u6807\u51c6\uff0c\u6309GNU\u901a\u7528\u516c\u5171\u8bb8\u53ef\u8bc1\u53d1\u884c\u3002\r\n\r\nLinux kernel5.8\u4e4b\u524d\u7248\u672c\u4e2d\u7684fs/block_dev.c\u5b58\u5728\u91ca\u653e\u540e\u91cd\u7528\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9\u67d0\u9519\u8bef\u5b57\u6bb5\u7684\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\u3002\u672c\u5730\u7528\u6237\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u5f97\u7279\u6743\u6216\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Linux kernel\u91ca\u653e\u540e\u91cd\u7528\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Linux Linux kernel \u003c5.8"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-15436",
  "serverity": "\u4f4e",
  "submitTime": "2020-11-24",
  "title": "Linux kernel\u91ca\u653e\u540e\u91cd\u7528\u6f0f\u6d1e"
}

FKIE_CVE-2020-15436

Vulnerability from fkie_nvd - Published: 2020-11-23 21:15 - Updated: 2026-06-17 02:56

Severity

6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
securities@openeuler.org	https://lkml.org/lkml/2020/6/7/379	Exploit, Patch, Vendor Advisory
securities@openeuler.org	https://security.netapp.com/advisory/ntap-20201218-0002/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lkml.org/lkml/2020/6/7/379	Exploit, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20201218-0002/	Third Party Advisory

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
broadcom	brocade_fabric_operating_system_firmware	-
netapp	cloud_backup	-
netapp	solidfire_\&_hci_management_node	-
netapp	solidfire_baseboard_management_controller_firmware	-
netapp	solidfire_baseboard_management_controller	-
netapp	h410c_firmware	-
netapp	h410c	-
netapp	h610c_firmware	-
netapp	h610c	-
netapp	h610s_firmware	-
netapp	h610s	-
netapp	h615c_firmware	-
netapp	h615c	-
netapp	a700s_firmware	-
netapp	a700s	-
netapp	aff_8700_firmware	-
netapp	aff_8700	-
netapp	fas_8700_firmware	-
netapp	fas_8700	-
netapp	aff_8300_firmware	-
netapp	aff_8300	-
netapp	fas_8300_firmware	-
netapp	fas_8300	-
netapp	aff_a400_firmware	-
netapp	aff_a400	-
netapp	fabric-attached_storage_a400_firmware	-
netapp	fabric-attached_storage_a400	-
netapp	a250_firmware	-
netapp	a250	-
netapp	aff_500f_firmware	-
netapp	aff_500f	-
netapp	fas_500f_firmware	-
netapp	fas_500f	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "linux kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "5.7 (verified), possibly others 4.18"
            }
          ]
        }
      ],
      "source": "securities@openeuler.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA9AE6DE-39FB-4119-AD8F-03D9E12D699F",
              "versionEndExcluding": "4.4.229",
              "versionStartIncluding": "2.6.38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C7D30FF-7984-4EB3-AF8A-0E29064F16AC",
              "versionEndExcluding": "4.9.229",
              "versionStartIncluding": "4.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE916088-825A-4296-BD7D-7016A72F957A",
              "versionEndExcluding": "4.14.186",
              "versionStartIncluding": "4.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D43D9AB3-E226-4A4C-963C-2B77834AD8EC",
              "versionEndExcluding": "4.19.130",
              "versionStartIncluding": "4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0D47E73-D50E-4A82-B7B9-26452AD64BBE",
              "versionEndExcluding": "5.4.49",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D2A3E90-AD7E-4224-926C-E4B10ABFE1DB",
              "versionEndExcluding": "5.7.6",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2748912-FC54-47F6-8C0C-B96784765B8E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire_\\\u0026_hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6D700C5-F67F-4FFB-BE69-D524592A3D2E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB9B8171-F6CA-427D-81E0-6536D3BBFA8D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "090AA6F4-4404-4E26-82AB-C3A22636F276",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDDF61B7-EC5C-467C-B710-B89F502CD04F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "89612649-BACF-4FAC-9BA4-324724FD93A6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3D9B255-C1AF-42D1-BF9B-13642FBDC080",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7CFE0E-9D1E-4495-B302-89C3096FC0DF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F63A3FA7-AAED-4A9D-9FDE-6195302DA0F6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5921A877-18BF-43FE-915C-D226E140ACFC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7296A1F2-D315-4FD5-8A73-65C480C855BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FDD92BFA-9117-4E6E-A13F-ED064B4B7284",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B7DA42F-5D64-4967-A2D4-6210FE507841",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "70ECC434-DF20-49A6-B4CF-D5CCA480E57D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "232DC609-8023-41F9-8CE3-1B31CE2F2D93",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF5AFE69-7990-4F80-9E63-D8AD58AA3A2D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6415E28A-4EAC-4F7F-BD81-1A55CE8B6F40",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA79D39A-A5F2-4C44-A805-5113065F8C25",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CA55FBD-6EBA-49C8-92BA-2B1BCCB18A3A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5CDADAB-72A5-4526-8432-E6C9AC56B29F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E64576DE-90F0-4F5E-9C82-AB745CFEDBB7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "56FD9B9A-BBE5-4CA5-B9F9-B16E1FE738C8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3E70A56-DBA8-45C7-8C49-1A036501156F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BA5679F-B7F4-482B-92B3-52121124829F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "02F063AC-FC82-45E4-A977-243FB3569904",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1236B66D-EB11-4324-929F-E2B86683C3C7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "281DFC67-46BB-4FC2-BE03-3C65C9311F65",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "578BB9A7-BF28-4068-A9A6-1DE19CEEC293",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2AB58180-E5E0-4056-ABF9-A99E9F6A9E86",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "86E430A7-F93D-422B-BC9E-99C17CC2BF6F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBC58E3E-C8AA-4400-8A48-733B321CC924",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de tipo use-after-free en el archivo fs/block_dev.c en el kernel de Linux versiones anteriores a 5.8, permite a usuarios locales obtener privilegios o causar una denegaci\u00f3n de servicio al aprovechar el acceso inapropiado a un determinado campo de error"
    }
  ],
  "id": "CVE-2020-15436",
  "lastModified": "2026-06-17T02:56:40.677",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-11-23T21:15:11.813",
  "references": [
    {
      "source": "securities@openeuler.org",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://lkml.org/lkml/2020/6/7/379"
    },
    {
      "source": "securities@openeuler.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201218-0002/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://lkml.org/lkml/2020/6/7/379"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201218-0002/"
    }
  ],
  "sourceIdentifier": "securities@openeuler.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-PCPR-HXM8-3MJ4

Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-10-19 19:00

Details

Severity

6.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-15436"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-23T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
  "id": "GHSA-pcpr-hxm8-3mj4",
  "modified": "2022-10-19T19:00:24Z",
  "published": "2022-05-24T17:34:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15436"
    },
    {
      "type": "WEB",
      "url": "https://lkml.org/lkml/2020/6/7/379"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20201218-0002"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2020-15436

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-15436

Aliases

CVE-2020-15436

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-15436",
    "description": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
    "id": "GSD-2020-15436",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-15436.html",
      "https://access.redhat.com/errata/RHSA-2021:2523",
      "https://access.redhat.com/errata/RHSA-2021:1376",
      "https://access.redhat.com/errata/RHSA-2021:0354",
      "https://access.redhat.com/errata/RHSA-2021:0338",
      "https://access.redhat.com/errata/RHSA-2021:0336",
      "https://ubuntu.com/security/CVE-2020-15436",
      "https://linux.oracle.com/cve/CVE-2020-15436.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-15436"
      ],
      "details": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
      "id": "GSD-2020-15436",
      "modified": "2023-12-13T01:21:43.484760Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "securities@openeuler.org",
        "ID": "CVE-2020-15436",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "linux kernel",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "5.7 (verified), possibly others 4.18"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Use After Free"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://lkml.org/lkml/2020/6/7/379",
            "refsource": "MISC",
            "url": "https://lkml.org/lkml/2020/6/7/379"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20201218-0002/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20201218-0002/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.7.6",
                "versionStartIncluding": "5.5",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.4.49",
                "versionStartIncluding": "4.20",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.19.130",
                "versionStartIncluding": "4.15",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.14.186",
                "versionStartIncluding": "4.10",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.9.229",
                "versionStartIncluding": "4.5",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.4.229",
                "versionStartIncluding": "2.6.38",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:solidfire_\\\u0026_hci_management_node:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "securities@openeuler.org",
          "ID": "CVE-2020-15436"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-416"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lkml.org/lkml/2020/6/7/379",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://lkml.org/lkml/2020/6/7/379"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201218-0002/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20201218-0002/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 0.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-10-12T13:31Z",
      "publishedDate": "2020-11-23T21:15Z"
    }
  }
}

ICSA-24-074-07

Vulnerability from csaf_cisa - Published: 2024-03-14 06:00 - Updated: 2024-03-14 06:00

Summary

Siemens SIMATIC

Notes

Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation: Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of a privileged process.

Critical infrastructure sectors: Critical Manufacturing

Countries/areas deployed: Worldwide

Company headquarters location: Germany

Recommended Practices: CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Recommended Practices: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Recommended Practices: CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Recommended Practices: Do not click web links or open attachments in unsolicited email messages.

Recommended Practices: Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Recommended Practices: Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

Recommended Practices: No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

CVE-2017-14491

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2017-18509

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-20 - Improper Input Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-0338

5.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-0417

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-732 - Incorrect Permission Assignment for Critical Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-10768

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-440 - Expected Behavior Violation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-11301

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-287 - Improper Authentication

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-14305

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-14381

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-15436

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-24587

2.6 (Low)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-326 - Inadequate Encryption Strength

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-25705

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-330 - Use of Insufficiently Random Values

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-26555

5.4 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-863 - Incorrect Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-26558

4.2 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-287 - Improper Authentication

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-29660

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-667 - Improper Locking

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2020-29661

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-667 - Improper Locking

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0302

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0305

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0325

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0326

7.5 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0327

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-269 - Improper Privilege Management

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0328

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0329

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0330

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0331

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0333

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0334

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-732 - Incorrect Permission Assignment for Critical Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0336

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-732 - Incorrect Permission Assignment for Critical Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0337

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-312 - Cleartext Storage of Sensitive Information

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0339

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0341

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-295 - Improper Certificate Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0390

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0391

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0392

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-415 - Double Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0393

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0394

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0396

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0397

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-415 - Double Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0399

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0400

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-20 - Improper Input Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0429

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0431

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0433

8.0 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0434

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0435

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-665 - Improper Initialization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0436

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0437

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-415 - Double Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0438

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0443

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0444

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0471

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0473

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-908 - Use of Uninitialized Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0474

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0476

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0478

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-755 - Improper Handling of Exceptional Conditions

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0480

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0481

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-20 - Improper Input Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0484

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-909 - Missing Initialization of Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0506

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0507

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0508

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0509

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0510

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0511

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-20 - Improper Input Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0512

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0513

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0514

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0515

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0516

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0519

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0520

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0521

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0522

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0584

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0585

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0586

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0587

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0588

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-668 - Exposure of Resource to Wrong Sphere

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0589

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0591

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0593

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0594

8.0 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0596

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0597

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0598

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0599

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0600

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-20 - Improper Input Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0601

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-415 - Double Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0604

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0640

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0641

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0642

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0646

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0650

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0651

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0652

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0653

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0682

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0683

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0684

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0687

5.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE-834 - Excessive Iteration

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0688

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0689

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0690

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0692

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-732 - Incorrect Permission Assignment for Critical Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0695

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0704

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-281 - Improper Preservation of Permissions

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0706

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0708

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0870

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0919

5.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0920

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0926

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0928

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-755 - Improper Handling of Exceptional Conditions

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0929

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0930

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0931

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0933

8.0 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-116 - Improper Encoding or Escaping of Output

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0952

5.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE-311 - Missing Encryption of Sensitive Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0953

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-281 - Improper Preservation of Permissions

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0961

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-909 - Missing Initialization of Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0963

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0964

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-681 - Incorrect Conversion between Numeric Types

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0965

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-862 - Missing Authorization

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0967

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0968

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-0970

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-1972

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-1976

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-29647

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-909 - Missing Initialization of Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-33909

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-38204

6.8 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-39621

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-732 - Incorrect Permission Assignment for Critical Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-39623

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-39626

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-39627

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-732 - Incorrect Permission Assignment for Critical Resource

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-39629

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-39633

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2021-39634

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20127

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-415 - Double Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20130

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20227

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20229

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20355

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20411

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20421

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20422

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20423

4.6 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20462

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20466

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-1188 - Initialization of a Resource with an Insecure Default

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20468

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20469

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20472

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20473

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20476

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20483

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-191 - Integer Underflow (Wrap or Wraparound)

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20498

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

CVE-2022-20500

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-755 - Improper Handling of Exceptional Conditions

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Siemens SIMATIC RF160B (6GT2003-0FA00): <V2.2 Siemens / SIMATIC RF160B (6GT2003-0FA00)		<V2.2	Mitigation Mitigation fix Mitigation fix Mitigation fix

References

198 references

URL	Category
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://www.cisa.gov/news-events/ics-advisories/i…	self
https://www.cisa.gov/resources-tools/resources/ic…	external
https://www.cisa.gov/sites/default/files/publicat…	external
https://www.cisa.gov/topics/industrial-control-systems	external
https://www.cisa.gov/uscert/sites/default/files/p…	external
https://www.cisa.gov/uscert/ncas/tips/ST04-014	external
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-…	external
https://us-cert.cisa.gov/sites/default/files/reco…	external
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B	external
https://www.cve.org/CVERecord?id=CVE-2017-14491	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2017-18509	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-0338	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-0417	external
https://www.cve.org/CVERecord?id=CVE-2020-10768	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-11301	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-14305	external
https://www.cve.org/CVERecord?id=CVE-2020-14381	external
https://www.cve.org/CVERecord?id=CVE-2020-15436	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-24587	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-25705	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-26555	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-26558	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-29660	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2020-29661	external
https://www.cve.org/CVERecord?id=CVE-2021-0302	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0305	external
https://www.cve.org/CVERecord?id=CVE-2021-0325	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0326	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0327	external
https://www.cve.org/CVERecord?id=CVE-2021-0328	external
https://www.cve.org/CVERecord?id=CVE-2021-0329	external
https://www.cve.org/CVERecord?id=CVE-2021-0330	external
https://www.cve.org/CVERecord?id=CVE-2021-0331	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0333	external
https://www.cve.org/CVERecord?id=CVE-2021-0334	external
https://www.cve.org/CVERecord?id=CVE-2021-0336	external
https://www.cve.org/CVERecord?id=CVE-2021-0337	external
https://www.cve.org/CVERecord?id=CVE-2021-0339	external
https://www.cve.org/CVERecord?id=CVE-2021-0341	external
https://www.cve.org/CVERecord?id=CVE-2021-0390	external
https://www.cve.org/CVERecord?id=CVE-2021-0391	external
https://www.cve.org/CVERecord?id=CVE-2021-0392	external
https://www.cve.org/CVERecord?id=CVE-2021-0393	external
https://www.cve.org/CVERecord?id=CVE-2021-0394	external
https://www.cve.org/CVERecord?id=CVE-2021-0396	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0397	external
https://www.cve.org/CVERecord?id=CVE-2021-0399	external
https://www.cve.org/CVERecord?id=CVE-2021-0400	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0429	external
https://www.cve.org/CVERecord?id=CVE-2021-0431	external
https://www.cve.org/CVERecord?id=CVE-2021-0433	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0434	external
https://www.cve.org/CVERecord?id=CVE-2021-0435	external
https://www.cve.org/CVERecord?id=CVE-2021-0436	external
https://www.cve.org/CVERecord?id=CVE-2021-0437	external
https://www.cve.org/CVERecord?id=CVE-2021-0438	external
https://www.cve.org/CVERecord?id=CVE-2021-0443	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0444	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0471	external
https://www.cve.org/CVERecord?id=CVE-2021-0473	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0474	external
https://www.cve.org/CVERecord?id=CVE-2021-0476	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0478	external
https://www.cve.org/CVERecord?id=CVE-2021-0480	external
https://www.cve.org/CVERecord?id=CVE-2021-0481	external
https://www.cve.org/CVERecord?id=CVE-2021-0484	external
https://www.cve.org/CVERecord?id=CVE-2021-0506	external
https://www.cve.org/CVERecord?id=CVE-2021-0507	external
https://www.cve.org/CVERecord?id=CVE-2021-0508	external
https://www.cve.org/CVERecord?id=CVE-2021-0509	external
https://www.cve.org/CVERecord?id=CVE-2021-0510	external
https://www.cve.org/CVERecord?id=CVE-2021-0511	external
https://www.cve.org/CVERecord?id=CVE-2021-0512	external
https://www.cve.org/CVERecord?id=CVE-2021-0513	external
https://www.cve.org/CVERecord?id=CVE-2021-0514	external
https://www.cve.org/CVERecord?id=CVE-2021-0515	external
https://www.cve.org/CVERecord?id=CVE-2021-0516	external
https://www.cve.org/CVERecord?id=CVE-2021-0519	external
https://www.cve.org/CVERecord?id=CVE-2021-0520	external
https://www.cve.org/CVERecord?id=CVE-2021-0521	external
https://www.cve.org/CVERecord?id=CVE-2021-0522	external
https://www.cve.org/CVERecord?id=CVE-2021-0584	external
https://www.cve.org/CVERecord?id=CVE-2021-0585	external
https://www.cve.org/CVERecord?id=CVE-2021-0586	external
https://www.cve.org/CVERecord?id=CVE-2021-0587	external
https://www.cve.org/CVERecord?id=CVE-2021-0588	external
https://www.cve.org/CVERecord?id=CVE-2021-0589	external
https://www.cve.org/CVERecord?id=CVE-2021-0591	external
https://www.cve.org/CVERecord?id=CVE-2021-0593	external
https://www.cve.org/CVERecord?id=CVE-2021-0594	external
https://www.cve.org/CVERecord?id=CVE-2021-0596	external
https://www.cve.org/CVERecord?id=CVE-2021-0597	external
https://www.cve.org/CVERecord?id=CVE-2021-0598	external
https://www.cve.org/CVERecord?id=CVE-2021-0599	external
https://www.cve.org/CVERecord?id=CVE-2021-0600	external
https://www.cve.org/CVERecord?id=CVE-2021-0601	external
https://www.cve.org/CVERecord?id=CVE-2021-0604	external
https://www.cve.org/CVERecord?id=CVE-2021-0640	external
https://www.cve.org/CVERecord?id=CVE-2021-0641	external
https://www.cve.org/CVERecord?id=CVE-2021-0642	external
https://www.cve.org/CVERecord?id=CVE-2021-0646	external
https://www.cve.org/CVERecord?id=CVE-2021-0650	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0651	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0652	external
https://www.cve.org/CVERecord?id=CVE-2021-0653	external
https://www.cve.org/CVERecord?id=CVE-2021-0682	external
https://www.cve.org/CVERecord?id=CVE-2021-0683	external
https://www.cve.org/CVERecord?id=CVE-2021-0684	external
https://www.cve.org/CVERecord?id=CVE-2021-0687	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0688	external
https://www.cve.org/CVERecord?id=CVE-2021-0689	external
https://www.cve.org/CVERecord?id=CVE-2021-0690	external
https://www.cve.org/CVERecord?id=CVE-2021-0692	external
https://www.cve.org/CVERecord?id=CVE-2021-0695	external
https://www.cve.org/CVERecord?id=CVE-2021-0704	external
https://www.cve.org/CVERecord?id=CVE-2021-0706	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0708	external
https://www.cve.org/CVERecord?id=CVE-2021-0870	external
https://www.cve.org/CVERecord?id=CVE-2021-0919	external
https://www.cve.org/CVERecord?id=CVE-2021-0920	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0926	external
https://www.cve.org/CVERecord?id=CVE-2021-0928	external
https://www.cve.org/CVERecord?id=CVE-2021-0929	external
https://www.cve.org/CVERecord?id=CVE-2021-0930	external
https://www.cve.org/CVERecord?id=CVE-2021-0931	external
https://www.cve.org/CVERecord?id=CVE-2021-0933	external
https://www.cve.org/CVERecord?id=CVE-2021-0952	external
https://www.cve.org/CVERecord?id=CVE-2021-0953	external
https://www.cve.org/CVERecord?id=CVE-2021-0961	external
https://www.cve.org/CVERecord?id=CVE-2021-0963	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-0964	external
https://www.cve.org/CVERecord?id=CVE-2021-0965	external
https://www.cve.org/CVERecord?id=CVE-2021-0967	external
https://www.cve.org/CVERecord?id=CVE-2021-0968	external
https://www.cve.org/CVERecord?id=CVE-2021-0970	external
https://www.cve.org/CVERecord?id=CVE-2021-1972	external
https://www.cve.org/CVERecord?id=CVE-2021-1976	external
https://www.cve.org/CVERecord?id=CVE-2021-29647	external
https://www.cve.org/CVERecord?id=CVE-2021-33909	external
https://www.cve.org/CVERecord?id=CVE-2021-38204	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2021-39621	external
https://www.cve.org/CVERecord?id=CVE-2021-39623	external
https://www.cve.org/CVERecord?id=CVE-2021-39626	external
https://www.cve.org/CVERecord?id=CVE-2021-39627	external
https://www.cve.org/CVERecord?id=CVE-2021-39629	external
https://www.cve.org/CVERecord?id=CVE-2021-39633	external
https://www.cve.org/CVERecord?id=CVE-2021-39634	external
https://www.cve.org/CVERecord?id=CVE-2022-20127	external
https://www.cve.org/CVERecord?id=CVE-2022-20130	external
https://www.cve.org/CVERecord?id=CVE-2022-20227	external
https://www.cve.org/CVERecord?id=CVE-2022-20229	external
https://www.cve.org/CVERecord?id=CVE-2022-20355	external
https://www.cve.org/CVERecord?id=CVE-2022-20411	external
https://www.cve.org/CVERecord?id=CVE-2022-20421	external
https://www.cve.org/CVERecord?id=CVE-2022-20422	external
https://www.cve.org/CVERecord?id=CVE-2022-20423	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2022-20462	external
https://www.cve.org/CVERecord?id=CVE-2022-20466	external
https://www.cve.org/CVERecord?id=CVE-2022-20468	external
https://www.first.org/cvss/calculator/3.1#CVSS:3.…	external
https://www.cve.org/CVERecord?id=CVE-2022-20469	external
https://www.cve.org/CVERecord?id=CVE-2022-20472	external
https://www.cve.org/CVERecord?id=CVE-2022-20473	external
https://www.cve.org/CVERecord?id=CVE-2022-20476	external
https://www.cve.org/CVERecord?id=CVE-2022-20483	external
https://www.cve.org/CVERecord?id=CVE-2022-20498	external
https://www.cve.org/CVERecord?id=CVE-2022-20500	external

Acknowledgments

Siemens

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of a privileged process.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Do not click web links or open attachments in unsolicited email messages.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-074-07 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-074-07.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-24-074-07 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-07"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SIMATIC",
    "tracking": {
      "current_release_date": "2024-03-14T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-24-074-07",
      "initial_release_date": "2024-03-14T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-03-14T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.2",
                "product": {
                  "name": "Siemens SIMATIC RF160B (6GT2003-0FA00): \u003cV2.2",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC RF160B (6GT2003-0FA00)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-14491",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An attacker could cause a crash or potentially execute arbitrary code by sending specially crafted DNS responses to the DNSmasq process. In order to exploit this vulnerability, an attacker must be able to trigger DNS requests from the device, and must be in a privileged position to inject malicious DNS responses.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-18509",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-18509"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-0338",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In checkKeyIntent of AccountManagerService.java, there is a possible permission bypass. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-9 Android ID: A-123700107",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-0338"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-0417",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-8.1, Android-9 Android ID: A-154319182",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-0417"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-10768",
      "cwe": {
        "id": "CWE-440",
        "name": "Expected Behavior Violation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being \u0027force disabled\u0027 when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-10768"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11301",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11301"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-14305",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An out-of-bounds memory write flaw was found in how the Linux kernel\u0027s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-14381",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A flaw was found in the Linux kernel\u0027s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14381"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-15436",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-15436"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-24587",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn\u0027t require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-24587"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-25705",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A flaw in ICMP packets in the Linux kernel was found to allow to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well. Kernel versions before 5.10 may be vulnerable to this issue.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25705"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-26555",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-26558",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-29660",
      "cwe": {
        "id": "CWE-667",
        "name": "Improper Locking"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-29660"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-29661",
      "cwe": {
        "id": "CWE-667",
        "name": "Improper Locking"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-29661"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0302",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1 Android-9 Android-10Android ID: A-155287782",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0302"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0305",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10 Android ID: A-154015447",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0305"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0325",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ih264d_parse_pslice of ih264d_parse_pslice.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-174238784",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0325"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0326",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In p2p_copy_client_info of p2p.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi direct search, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-172937525",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0326"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0327",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored binder identities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-172935267",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0327"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0328",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan results without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-172670415",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0328"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0329",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In several native functions called by AdvertiseManager.java, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege in the Bluetooth server with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-171400004",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0329"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0330",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in storaged with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11 Android ID: A-170732441",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0330"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0331",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification access with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-170731783",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0331"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0333",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth device is connecting. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-168504491",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0333"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0334",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-163358811",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0334"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0336",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent. This could lead to local escalation of privilege that bypasses a permission check, with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-158219161",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0336"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0337",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-157474195",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0337"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0339",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app is brought to the foreground. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-8.1, Android-9 Android ID: A-145728687",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0339"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0341",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-171980069",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0390",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check. This could lead to local escalation of privilege by a background user on the same device with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174749461",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0390"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0391",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-172841550",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0391"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0392",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In main of main.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-175124730",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0392"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0393",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution if an attacker can supply a malicious PAC file, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-168041375",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0393"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0394",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-172655291",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0394"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0396",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-160610106",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0396"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0397",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174052148",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0397"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0399",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-176919394References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0399"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0400",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11 Android ID: A-177561690",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0400"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0429",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-175074139",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0429"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0431",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In avrc_msg_cback of avrc_api.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174149901",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0431"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0433",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-171221090",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0433"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0434",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onReceive of BluetoothPermissionRequest.java, a phishing attack is possible allowing a malicious Bluetooth device to acquire permissions based on insufficient information presented to the user in the consent dialog. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-167403112",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0434"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0435",
      "cwe": {
        "id": "CWE-665",
        "name": "Improper Initialization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174150451",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0435"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0436",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out-of-bounds read due to integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-176496160",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0436"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0437",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-176168330",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0437"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0438",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10 Android ID: A-152064592",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0438"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0443",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. This could lead to local information disclosure across user profiles with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-170474245",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0443"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0444",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent. This could lead to local information disclosure of contact data with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-178825358",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0444"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0471",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-176444786",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0471"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0473",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-179687208",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0473"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0474",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In avrc_msg_cback of avrc_api.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-177611958",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0474"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0476",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In FindOrCreatePeer of btif_av.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-169252501",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0476"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0478",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In updateDrawable of StatusBarIconView.java, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege by running foreground services without notifying the user, with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-169255797",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0478"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0480",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In createPendingIntent of SnoozeHelper.java, there is a possible broadcast intent containing a sensitive identifier. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-174493336",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0480"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0481",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpected URI handler. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-172939189",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0481"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0484",
      "cwe": {
        "id": "CWE-909",
        "name": "Missing Initialization of Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-173720767",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0484"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0506",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-181962311",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0506"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0507",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In handle_rc_metamsg_cmd of btif_rc.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-181860042",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0507"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0508",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-176444154",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0508"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0509",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-176444161",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0509"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0510",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-176444622",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0510"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0511",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11 Android ID: A-178055795",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0511"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0512",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-173843328References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0512"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0513",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission bypass due to improper state validation. This could lead to local escalation of privilege via hidden services with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-156090809",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0513"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0514",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In several functions of the V8 library, there is a possible use after free due to a race condition. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-9, Android-11, Android-8.1 Android ID: A-162604069",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0514"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0515",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-167389063",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0515"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0516",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In p2p_process_prov_disc_req of p2p_pd.c, there is a possible out-of-bounds read and write due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-181660448",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0516"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0519",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-176533109",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0519"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0520",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-10 Android ID: A-176237595",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0520"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0521",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of cross-user permissions with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174661955",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0521"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0522",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ConnectionHandler::SdpCb of connection_handler.cc, there is a possible out-of-bounds read due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-174182139",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0522"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0584",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In verifyBufferObject of Parcel.cpp, there is a possible out-of-bounds read due to an improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-179289794",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0584"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0585",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In beginWrite and beginRead of MessageQueueBase.h, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-184963385",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0585"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0586",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-182584940",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0586"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0587",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out-of-bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-185259758",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0587"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0588",
      "cwe": {
        "id": "CWE-668",
        "name": "Exposure of Resource to Wrong Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9 Android ID: A-177238342",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0588"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0589",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-180939982",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0589"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0591",
      "cwe": {
        "id": "CWE-610",
        "name": "Externally Controlled Reference to a Resource in Another Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-179386960",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0591"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0593",
      "cwe": {
        "id": "CWE-610",
        "name": "Externally Controlled Reference to a Resource in Another Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-179386068",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0593"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0594",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-176445224",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0594"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0596",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-181346550",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0596"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0597",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-176496502",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0597"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0598",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-180422108",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0598"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0599",
      "cwe": {
        "id": "CWE-610",
        "name": "Externally Controlled Reference to a Resource in Another Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-175614289",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0599"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0600",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-179042963",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0600"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0601",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out-of-bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-180643802",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0601"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0604",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-179910660",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0604"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0640",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In noteAtomLogged of StatsdStats.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-187957589",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0640"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0641",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-185235454",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0641"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0642",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-185126149",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0642"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0646",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sqlite3_str_vappendf of sqlite3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege if the user can also inject a printf into a privileged process\u0027s SQL with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-153352319",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0646"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0650",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-190286685",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0650"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0651",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In loadLabel of PackageItemInfo.java, there is a possible way to cause a denial of service in a device by having a long label in an app due to incorrect input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-67013844",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0651"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0652",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due to sharing objects that are not thread-safe. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-185178568",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0652"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0653",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-177931370",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0653"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0682",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-159624555",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0682"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0683",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In runTraceIpcStop of ActivityManagerShellCommand.java, deletion of system files is possible due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-185398942",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0683"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0684",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out-of-bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-179839665",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0684"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0687",
      "cwe": {
        "id": "CWE-834",
        "name": "Excessive Iteration"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ellipsize of Layout.java, there is a possible ANR due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-188913943",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0687"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0688",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-161149543",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0688"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0689",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In RGB_to_BGR1_portable of SkSwizzler_opts.h, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-190188264",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0689"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0690",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out-of-bounds write due to heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-182152757",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0690"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0692",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-179289753",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0692"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0695",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In get_sock_stat of xt_qtaguid.c, there is a possible out-of-bounds read due to a use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-184018316References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0695"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0704",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accounts from the device without permissions due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-179338675",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0704"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0706",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Android Versions: Android-10 Android-11Android ID: A-193444889",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0706"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0708",
      "cwe": {
        "id": "CWE-610",
        "name": "Externally Controlled Reference to a Resource in Another Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In runDumpHeap of ActivityManagerShellCommand.java, deletion of system files is possible due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-183262161",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0708"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0870",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In RW_SetActivatedTagType of rw_main.cc, memory corruption is possible due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-192472262",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0870"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0919",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow. This could lead to local denial of service making the lockscreen unusable with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-197336441",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0919"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0920",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-196926917References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0920"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0926",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user\u0027s consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-191053931",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0926"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0928",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-188675581",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0928"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0929",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-187527909 References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0929"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0930",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-181660091",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0930"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0931",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-180747689",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0931"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0933",
      "cwe": {
        "id": "CWE-116",
        "name": "Improper Encoding or Escaping of Output"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetooth device, with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-172251622",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0933"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0952",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure of user\u0027s contacts with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-195748381",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0952"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0953",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-184046278",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0953"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0961",
      "cwe": {
        "id": "CWE-909",
        "name": "Missing Initialization of Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-196046570References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0961"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0963",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-199754277",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0963"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0964",
      "cwe": {
        "id": "CWE-681",
        "name": "Incorrect Conversion between Numeric Types"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-193363621",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0964"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0965",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user\u0027s consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-194300867",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0965"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0967",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In vorbis_book_decodev_set of codebook.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-199065614",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0967"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0968",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In osi_malloc and osi_calloc of allocator.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-197868577",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0968"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-0970",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-196970023",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-0970"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-1972",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-1972"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-1976",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice \u0026 Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-1976"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-29647",
      "cwe": {
        "id": "CWE-909",
        "name": "Missing Initialization of Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-29647"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-33909",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an out-of-bounds write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-38204",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-38204"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-39621",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-185126319",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39621"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-39623",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In doRead of SimpleDecodingSource.cpp, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-194105348",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39623"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-39626",
      "cwe": {
        "id": "CWE-610",
        "name": "Externally Controlled Reference to a Resource in Another Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-194695497",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39626"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-39627",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-185126549",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39627"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-39629",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-197353344",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39629"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-39633",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-150694665 References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39633"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-39634",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-204450605References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39634"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20127",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In ce_t4t_data_cback of ce_t4t.cc, there is a possible out-of-bounds write due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-221862119",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20127"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20130",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-224314979",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20130"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20227",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In USB driver, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-216825460 References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20227"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20229",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-224536184",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20229"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20355",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-219498290",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20355"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20411",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In avdt_msg_asmbl of avdt_msg.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-232023771",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20411"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20421",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-239630375 References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20422",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-237540956 References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20423",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In rndis_set_response of rndis.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-239842288 References: Upstream kernel",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20423"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20462",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-230356196",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20462"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20466",
      "cwe": {
        "id": "CWE-1188",
        "name": "Initialization of a Resource with an Insecure Default"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user\u0027s password on a secondary display due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-179725730",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20466"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20468",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BNEP_ConnectResp of bnep_api.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-228450451",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20468"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20469",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-230867224",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20469"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20472",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In toLanguageTag of LocaleListCache.cpp, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-239210579",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20472"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20473",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In toLanguageTag of LocaleListCache.cpp, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-239267173",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20473"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20476",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-240936919",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20476"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20483",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out-of-bounds reads due to integer overflows. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-242459126",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20483"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20498",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In fdt_path_offset_namelen of fdt_ro.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-246465319",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20498"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-20500",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-246540168",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-20500"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.siemens.com/industrialsecurity"
        },
        {
          "category": "mitigation",
          "details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

MSRC_CVE-2020-15436

Vulnerability from csaf_microsoft - Published: 2020-11-02 00:00 - Updated: 2020-12-03 00:00

Summary

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2020-15436

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 19137-16820		—

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 16820-1		—	Vendor Fix fix

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2020/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2020/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2020-15436 Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field. - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2020/msrc_cve-2020-15436.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
    "tracking": {
      "current_release_date": "2020-12-03T00:00:00.000Z",
      "generator": {
        "date": "2025-10-19T18:11:40.604Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2020-15436",
      "initial_release_date": "2020-11-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2020-12-03T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.0",
                "product": {
                  "name": "CBL Mariner 1.0",
                  "product_id": "16820"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccm1 kernel 5.4.91-1",
                "product": {
                  "name": "\u003ccm1 kernel 5.4.91-1",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "cm1 kernel 5.4.91-1",
                "product": {
                  "name": "cm1 kernel 5.4.91-1",
                  "product_id": "19137"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccm1 kernel 5.4.91-1 as a component of CBL Mariner 1.0",
          "product_id": "16820-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "16820"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cm1 kernel 5.4.91-1 as a component of CBL Mariner 1.0",
          "product_id": "19137-16820"
        },
        "product_reference": "19137",
        "relates_to_product_reference": "16820"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15436",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "general",
          "text": "openEuler",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "19137-16820"
        ],
        "known_affected": [
          "16820-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2020-15436 Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field. - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2020/msrc_cve-2020-15436.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-12-03T00:00:00.000Z",
          "details": "5.4.91-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "16820-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "16820-1"
          ]
        }
      ],
      "title": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field."
    }
  ]
}

OPENSUSE-SU-2020:2161-1

Vulnerability from csaf_opensuse - Published: 2020-12-04 22:35 - Updated: 2020-12-04 22:35

Summary

Security update for the Linux Kernel

Severity

Important

Notes

Title of the patch: Security update for the Linux Kernel

Description of the patch: The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-29369: There was a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bnc#1179432). - CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c, where uninitialized memory could leak to userspace, aka CID-bcf85fcedfdd (bnc#1179429). - CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c allowed local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field (bnc#1179141). - CVE-2020-25705: A flaw in the way reply ICMP packets are limited was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Kernel versions may be vulnerable to this issue (bnc#1175721 bnc#1178782). - CVE-2020-15437: The Linux kernel was vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allowed local users to cause a denial of service by using the p->serial_in pointer which uninitialized (bnc#1179140). - CVE-2020-27777: Restricted RTAS requests from userspace (bsc#1179107). - CVE-2020-28974: A slab-out-of-bounds read in fbcon could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height (bnc#1178589). - CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#1177666). - CVE-2020-28941: Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once (bnc#1178740). - CVE-2020-28915: A buffer over-read (at the framebuffer layer) in the fbcon code could be used by local attackers to read kernel memory, aka CID-6735b4632def (bnc#1178886). - CVE-2020-25669: Avoid a use-after-free in teardown paths in sunkbd (bsc#1178182). The following non-security bugs were fixed: - 9P: Cast to loff_t before multiplying (git-fixes). - ACPI: GED: fix -Wformat (git-fixes). - ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes). - ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes). - ACPI: dock: fix enum-conversion warning (git-fixes). - ACPICA: Add NHLT table signature (bsc#1176200). - ALSA: ctl: fix error path at adding user-defined element set (git-fixes). - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes). - ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes). - ALSA: hda/realtek - Add supported mute Led for HP (git-fixes). - ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes). - ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes). - ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes). - ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes). - ALSA: mixart: Fix mutex deadlock (git-fixes). - ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes). - ASoC: qcom: lpass-platform: Fix memory leak (git-fixes). - Add bug reference to two hv_netvsc patches (bsc#1178853). - Convert trailing spaces and periods in path components (bsc#1179424). - Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU (bsc#1177353, bsc#1179076). - Drop sysctl files for dropped archs, add ppc64le and arm (bsc#1178838). Also correct the page size on ppc64. - EDAC/amd64: Cache secondary Chip Select registers (bsc#1179001). - EDAC/amd64: Find Chip Select memory size using Address Mask (bsc#1179001). - EDAC/amd64: Gather hardware information early (bsc#1179001). - EDAC/amd64: Initialize DIMM info for systems with more than two channels (bsc#1179001). - EDAC/amd64: Make struct amd64_family_type global (bsc#1179001). - EDAC/amd64: Save max number of controllers to family type (bsc#1179001). - EDAC/amd64: Support asymmetric dual-rank DIMMs (bsc#1179001). - Fix wrongly set CONFIG_SOUNDWIRE=y (bsc#1179201) CONFIG_SOUNDWIRE was mistakenly set as built-in. Mark it as module. - HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver (git-fixes). - HID: logitech-dj: Fix an error in mse_bluetooth_descriptor (git-fixes). - HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad (git-fixes). - HID: logitech-hidpp: Add PID for MX Anywhere 2 (git-fixes). - Input: adxl34x - clean up a data type in adxl34x_probe() (git-fixes). - Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER (git-fixes). - KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 does not return SMCCC_RET_NOT_REQUIRED (git-fixes). - NFS: only invalidate dentrys that are clearly invalid (bsc#1178669 bsc#1170139). - NFSv4.x recover from pre-mature loss of openstateid (bsc#1176180). - NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE (bsc#1176180). - NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE (bsc#1176180). - RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP (jsc#SLE-8449). - RDMA/hns: Fix the wrong value of rnr_retry when querying qp (jsc#SLE-8449). - RDMA/hns: Fix wrong field of SRQ number the device supports (jsc#SLE-8449). - RDMA/hns: Solve the overflow of the calc_pg_sz() (jsc#SLE-8449). - RDMA/mlx5: Fix devlink deadlock on net namespace deletion (jsc#SLE-8464). - RDMA/qedr: Fix return code if accept is called on a destroyed qp (jsc#SLE-8215). - RDMA/ucma: Add missing locking around rdma_leave_multicast() (git-fixes). - Revert 'cdc-acm: hardening against malicious devices' (git-fixes). - Revert 'kernel/reboot.c: convert simple_strtoul to kstrtoint' (git-fixes). - SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow() (git-fixes). - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (bsc#1154353). - USB: Add NO_LPM quirk for Kingston flash drive (git-fixes). - USB: core: Change %pK for __user pointers to %px (git-fixes). - USB: core: Fix regression in Hercules audio card (git-fixes). - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 (git-fixes). - USB: serial: option: add Quectel EC200T module support (git-fixes). - USB: serial: option: add Telit FN980 composition 0x1055 (git-fixes). - arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs (git-fixes). - arm64: Run ARCH_WORKAROUND_2 enabling code on all CPUs (git-fixes). - arm64: bpf: Fix branch offset in JIT (git-fixes). - arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay (git-fixes). - arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node (git-fixes). - arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node (git-fixes). - arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY (git-fixes). - arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay (git-fixes). - arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node (git-fixes). - arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node (git-fixes). - arm64: dts: fsl: DPAA FMan DMA operations are coherent (git-fixes). - arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point (git-fixes). - arm64: dts: imx8mq: Add missing interrupts to GPC (git-fixes). - arm64: dts: imx8mq: Fix TMU interrupt property (git-fixes). - arm64: dts: zynqmp: Remove additional compatible string for i2c IPs (git-fixes). - arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions (git-fixes). - arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes (git-fixes). - arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes (git-fixes). - arm64: tegra: Add missing timeout clock to Tegra210 SDMMC (git-fixes). - arm64: vdso: Add '-Bsymbolic' to ldflags (git-fixes). - arm64: vdso: Add --eh-frame-hdr to ldflags (git-fixes). - batman-adv: set .owner to THIS_MODULE (git-fixes). - bnxt_en: Avoid sending firmware messages when AER error is detected (jsc#SLE-8371 bsc#1153274). - bnxt_en: Check abort error state in bnxt_open_nic() (jsc#SLE-8371 bsc#1153274). - bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task() (jsc#SLE-8371 bsc#1153274). - bnxt_en: Fix regression in workqueue cleanup logic in bnxt_remove_one() (jsc#SLE-8371 bsc#1153274). - bnxt_en: Invoke cancel_delayed_work_sync() for PFs also (jsc#SLE-8371 bsc#1153274). - bnxt_en: Send HWRM_FUNC_RESET fw command unconditionally (jsc#SLE-8371 bsc#1153274). - bnxt_en: return proper error codes in bnxt_show_temp (git-fixes). - bpf: Do not rely on GCC __attribute__((optimize)) to disable GCSE (bsc#1155518). - bpf: Fix comment for helper bpf_current_task_under_cgroup() (bsc#1155518). - bpf: Zero-fill re-used per-cpu map element (bsc#1155518). - btrfs: fix bytes_may_use underflow in prealloc error condtition (bsc#1179217). - btrfs: fix metadata reservation for fallocate that leads to transaction aborts (bsc#1179217). - btrfs: fix relocation failure due to race with fallocate (bsc#1179217). - btrfs: remove item_size member of struct btrfs_clone_extent_info (bsc#1179217). - btrfs: rename btrfs_insert_clone_extent() to a more generic name (bsc#1179217). - btrfs: rename btrfs_punch_hole_range() to a more generic name (bsc#1179217). - btrfs: rename struct btrfs_clone_extent_info to a more generic name (bsc#1179217). - can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes). - can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes). - can: dev: can_restart(): post buffer from the right context (git-fixes). - can: flexcan: flexcan_setup_stop_mode(): add missing 'req_bit' to stop mode property comment (git-fixes). - can: gs_usb: fix endianess problem with candleLight firmware (git-fixes). - can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits (git-fixes). - can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (git-fixes). - can: m_can: m_can_handle_state_change(): fix state change (git-fixes). - can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes). - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes). - can: peak_usb: fix potential integer overflow on shift of a int (git-fixes). - ceph: add check_session_state() helper and make it global (bsc#1179012). - ceph: check session state after bumping session->s_seq (bsc#1179012). - ceph: check the sesion state and return false in case it is closed (bsc#1179012). - ceph: downgrade warning from mdsmap decode to debug (bsc#1178653). - ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635). - cfg80211: initialize wdev data earlier (git-fixes). - cfg80211: regulatory: Fix inconsistent format argument (git-fixes). - cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211). - cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426). - cifs: remove bogus debug code (bsc#1179427). - clk: define to_clk_regmap() as inline function (git-fixes). - cosa: Add missing kfree in error path of cosa_write (git-fixes). - dax: Fix stack overflow when mounting fsdax pmem device (bsc#1171073). - dax: fix detection of dax support for non-persistent memory block devices (bsc#1171073). - devlink: Make sure devlink instance and port are in same net namespace (bsc#1154353). - docs: ABI: sysfs-c2port: remove a duplicated entry (git-fixes). - drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873). - drivers/net/ethernet: remove incorrectly formatted doc (bsc#1177397). - efi/efivars: Set generic ops before loading SSDT (git-fixes). - efi/esrt: Fix reference count leak in esre_create_sysfs_entry (git-fixes). - efi/libstub/x86: Work around LLVM ELF quirk build regression (git-fixes). - efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper (git-fixes). - efi/x86: Do not panic or BUG() on non-critical error conditions (git-fixes). - efi/x86: Fix the deletion of variables in mixed mode (git-fixes). - efi/x86: Free efi_pgd with free_pages() (git-fixes). - efi/x86: Handle by-ref arguments covering multiple pages in mixed mode (git-fixes). - efi/x86: Ignore the memory attributes table on i386 (git-fixes). - efi/x86: Map the entire EFI vendor string before copying it (git-fixes). - efi: EFI_EARLYCON should depend on EFI (git-fixes). - efi: add missed destroy_workqueue when efisubsys_init fails (git-fixes). - efi: efibc: check for efivars write capability (git-fixes). - efi: provide empty efi_enter_virtual_mode implementation (git-fixes). - efivarfs: fix memory leak in efivarfs_create() (git-fixes). - efivarfs: revert 'fix memory leak in efivarfs_create()' (git-fixes). - fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h (git-fixes). - ftrace: Fix recursion check for NMI test (git-fixes). - ftrace: Handle tracing when switching between context (git-fixes). - futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1149032). - futex: Handle transient 'ownerless' rtmutex state correctly (bsc#1149032). - gpio: pcie-idio-24: Enable PEX8311 interrupts (git-fixes). - gpio: pcie-idio-24: Fix IRQ Enable Register value (git-fixes). - gpio: pcie-idio-24: Fix irq mask when masking (git-fixes). - hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() functions (git-fixes). - hv_balloon: disable warning when floor reached (git-fixes). - hv_netvsc: Add XDP support (bsc#1177820). - hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177820). - hv_netvsc: make recording RSS hash depend on feature flag (bsc#1177820). - hv_netvsc: record hardware hash in skb (bsc#1177820). - hwmon: (pwm-fan) Fix RPM calculation (git-fixes). - i2c: mediatek: move dma reset before i2c reset (git-fixes). - i2c: sh_mobile: implement atomic transfers (git-fixes). - igc: Fix not considering the TX delay for timestamps (bsc#1160634). - igc: Fix wrong timestamp latency numbers (bsc#1160634). - iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (git-fixes). - iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (git-fixes). - iio: adc: mediatek: fix unset field (git-fixes). - iio: light: fix kconfig dependency bug for VCNL4035 (git-fixes). - intel_idle: Customize IceLake server support (bsc#1178286). - ionic: check port ptr before use (bsc#1167773). - iwlwifi: mvm: write queue_sync_state only for sync (git-fixes). - kABI workaround for HD-audio (git-fixes). - kABI: revert use_mm name change (MM Functionality, bsc#1178426). - kernel-source.spec: Fix build with rpm 4.16 (boo#1179015). - kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082) - kernel/watchdog: fix watchdog_allowed_mask not used warning (git-fixes). - kernel: better document the use_mm/unuse_mm API contract (MM Functionality, bsc#1178426). - kgdb: Fix spurious true from in_dbg_master() (git-fixes). - kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled (git-fixes). - lan743x: fix 'BUG: invalid wait context' when setting rx mode (git-fixes). - lan743x: fix issue causing intermittent kernel log warnings (git-fixes). - lan743x: prevent entire kernel HANG on open, for some platforms (git-fixes). - lib/crc32test: remove extra local_irq_disable/enable (git-fixes). - lib/strncpy_from_user.c: Mask out bytes after NUL terminator (bsc#1155518). - libbpf, hashmap: Fix undefined behavior in hash_bits (bsc#1155518). - libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873). - libnvdimm/nvdimm/flush: Allow architecture to override the flush barrier (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - mac80211: always wind down STA state (git-fixes). - mac80211: fix use of skb payload instead of header (git-fixes). - mac80211: free sta in sta_info_insert_finish() on errors (git-fixes). - mac80211: minstrel: fix tx status processing corner case (git-fixes). - mac80211: minstrel: remove deferred sampling code (git-fixes). - mei: protect mei_cl_mtu from null dereference (git-fixes). - memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event (bsc#1177703). - mfd: sprd: Add wakeup capability for PMIC IRQ (git-fixes). - mm, THP, swap: fix allocating cluster for swapfile by mistake (bsc#1178755). - mm, memcg: fix inconsistent oom event behavior (bsc#1178659). - mm/gup: allow FOLL_FORCE for get_user_pages_fast() (git fixes (mm/gup)). - mm/gup: fix gup_fast with dynamic page table folding (bnc#1176586, LTC#188235). - mm/ksm: fix NULL pointer dereference when KSM zero page is enabled (git fixes (mm/ksm)). - mm/memcg: fix refcount error while moving and swapping (bsc#1178686). - mm/memcontrol.c: add missed css_put() (bsc#1178661). - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race (MM Functionality, bsc#1178426). - mm: fix kthread_use_mm() vs TLB invalidate (MM Functionality, bsc#1178426). - mm: mempolicy: require at least one nodeid for MPOL_PREFERRED (git fixes (mm/mempolicy)). - mm: swap: make page_evictable() inline (git fixes (mm/vmscan)). - mm: swap: use smp_mb__after_atomic() to order LRU bit set (git fixes (mm/vmscan)). - mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove (git-fixes). - mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs (git-fixes). - mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers (git-fixes). - modsign: Add codeSigning EKU when generating X.509 key generation config (bsc#1177353, bsc#1179076). - net/mlx5: Clear bw_share upon VF disable (jsc#SLE-8464). - net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled (jsc#SLE-8464). - net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send (bsc#1172873). - net: ena: Capitalize all log strings and improve code readability (bsc#1177397). - net: ena: Change RSS related macros and variables names (bsc#1177397). - net: ena: Change license into format to SPDX in all files (bsc#1177397). - net: ena: Change log message to netif/dev function (bsc#1177397). - net: ena: Fix all static chekers' warnings (bsc#1177397). - net: ena: Remove redundant print of placement policy (bsc#1177397). - net: ena: ethtool: Add new device statistics (bsc#1177397). - net: ena: ethtool: add stats printing to XDP queues (bsc#1177397). - net: ena: ethtool: convert stat_offset to 64 bit resolution (bsc#1177397). - net: ena: fix packet's addresses for rx_offset feature (bsc#1174852). - net: ena: handle bad request id in ena_netdev (bsc#1174852). - net: ena: xdp: add queue counters for xdp actions (bsc#1177397). - net: fix pos incrementment in ipv6_route_seq_next (bsc#1154353). - net: introduce helper sendpage_ok() in include/linux/net.h (bsc#1172873). - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition (git-fixes). - nfc: s3fwrn5: use signed integer for parsing GPIO numbers (git-fixes). - nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() (bsc#1172873). - nvme: do not update disk info for multipathed device (bsc#1171558). - pinctrl: amd: fix incorrect way to disable debounce filter (git-fixes). - pinctrl: amd: use higher precision for 512 RtcClk (git-fixes). - pinctrl: aspeed: Fix GPI only function problem (git-fixes). - pinctrl: intel: Set default bias in case no particular value given (git-fixes). - platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time (git-fixes). - platform/x86: toshiba_acpi: Fix the wrong variable assignment (git-fixes). - powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm (MM Functionality, bsc#1178426). - powerpc/perf: consolidate GPCI hcall structs into asm/hvcall.h (jsc#SLE-16360 jsc#SLE-16915). - powerpc/pmem: Add flush routines using new pmem store and sync instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Add new instructions for persistent storage and sync (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Avoid the barrier in flush routines (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Initialize pmem device on newer hardware (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Restrict papr_scm to P8 and above (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Update ppc64 to use the new barrier instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pseries: Add KVM guest doorbell restrictions (jsc#SLE-15869 jsc#SLE-16321). - powerpc/pseries: Use doorbells even if XIVE is available (jsc#SLE-15869 jsc#SLE-16321). - powerpc/pseries: new lparcfg key/value pair: partition_affinity_score (jsc#SLE-16360 jsc#SLE-16915). - powerpc/vnic: Extend 'failover pending' window (bsc#1176855 ltc#187293). - powerpc: Inline doorbell sending functions (jsc#SLE-15869 jsc#SLE-16321). - powerpc: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM (MM Functionality, bsc#1178426). - qla2xxx: Add MODULE_VERSION back to driver (bsc#1179160). - reboot: fix overflow parsing reboot cpu number (git-fixes). - regulator: avoid resolve_supply() infinite recursion (git-fixes). - regulator: fix memory leak with repeated set_machine_constraints() (git-fixes). - regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} (git-fixes). - regulator: ti-abb: Fix array out of bound read access on the first transition (git-fixes). - regulator: workaround self-referent regulators (git-fixes). - rfkill: Fix use-after-free in rfkill_resume() (git-fixes). - ring-buffer: Fix recursion protection transitions between interrupt context (git-fixes). - rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014) - rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014) - rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045) - rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401) - rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082). - rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one). - s390/bpf: Fix multiple tail calls (git-fixes). - s390/cpum_cf,perf: change DFLT_CCERROR counter name (bsc#1175918 LTC#187935). - s390/cpum_sf.c: fix file permission for cpum_sfb_size (git-fixes). - s390/dasd: fix null pointer dereference for ERP requests (git-fixes). - s390/pkey: fix paes selftest failure with paes and pkey static build (git-fixes). - s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl (bsc#1177070 LTC#188342). - s390/zcrypt: fix kmalloc 256k failure (bsc#1177066 LTC#188341). - sched/fair: Ensure tasks spreading in LLC during LB (git fixes (sched)). - sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list (git fixes (sched)). - sched: Fix loadavg accounting race on arm64 kabi (bnc#1178227). - sched: Fix rq->nr_iowait ordering (git fixes (sched)). - scripts/lib/SUSE/MyBS.pm: properly close prjconf Macros: section - scsi: libiscsi: Fix NOP race condition (bsc#1176481). - scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() (bsc#1172873). - spi: lpspi: Fix use-after-free on unbind (git-fixes). - staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (git-fixes). - svcrdma: fix bounce buffers for unaligned offsets and multiple pages (git-fixes). - tcp: use sendpage_ok() to detect misused .sendpage (bsc#1172873). - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() (git-fixes). - thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() (git-fixes). - timer: Fix wheel index calculation on last level (git-fixes). - timer: Prevent base->clk from moving backward (git-fixes). - tpm: efi: Do not create binary_bios_measurements file for an empty log (git-fixes). - tpm_tis: Disable interrupts on ThinkPad T490s (git-fixes). - tracing: Fix out of bounds write in get_trace_buf (git-fixes). - tty: serial: fsl_lpuart: LS1021A had a FIFO size of 16 words, like LS1028A (git-fixes). - tty: serial: fsl_lpuart: add LS1028A support (git-fixes). - tty: serial: imx: fix potential deadlock (git-fixes). - tty: serial: imx: keep console clocks always on (git-fixes). - uio: Fix use-after-free in uio_unregister_device() (git-fixes). - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (git-fixes). - usb: core: driver: fix stray tabs in error messages (git-fixes). - usb: gadget: Fix memleak in gadgetfs_fill_super (git-fixes). - usb: gadget: f_midi: Fix memleak in f_midi_alloc (git-fixes). - usb: gadget: goku_udc: fix potential crashes in probe (git-fixes). - usb: host: fsl-mph-dr-of: check return of dma_set_mask() (git-fixes). - usb: typec: tcpm: reset hard_reset_count for any disconnect (git-fixes). - video: hyperv_fb: Fix the cache type when mapping the VRAM (git-fixes). - video: hyperv_fb: include vmalloc.h (git-fixes). - virtio: virtio_console: fix DMA memory allocation for rproc serial (git-fixes). - vt: Disable KD_FONT_OP_COPY (bsc#1178589). - x86/hyperv: Clarify comment on x2apic mode (git-fixes). - x86/i8259: Use printk_deferred() to prevent deadlock (git-fixes). - x86/microcode/intel: Check patch signature before saving microcode for early loading (bsc#1152489). - x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (bsc#1152489). - xfs: fix a missing unlock on error in xfs_fs_map_blocks (git-fixes). - xfs: fix brainos in the refcount scrubber's rmap fragment processor (git-fixes). - xfs: fix flags argument to rmap lookup when converting shared file rmaps (git-fixes). - xfs: fix rmap key and record comparison functions (git-fixes). - xfs: revert 'xfs: fix rmap key and record comparison functions' (git-fixes). - xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents (git-fixes). - xhci: Fix sizeof() mismatch (git-fixes). - xhci: hisilicon: fix refercence leak in xhci_histb_probe (git-fixes).

Patchnames: openSUSE-2020-2161

CVE-2020-15436

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-15437

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-25669

4.3 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-25705

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2020-27777

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-28915

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-28941

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-28974

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-29369

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-29371

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2020-4788

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 19 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

115 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://lists.opensuse.org/archives/list/security…	self
https://lists.opensuse.org/archives/list/security…	self
https://bugzilla.suse.com/1149032	self
https://bugzilla.suse.com/1152489	self
https://bugzilla.suse.com/1153274	self
https://bugzilla.suse.com/1154353	self
https://bugzilla.suse.com/1155518	self
https://bugzilla.suse.com/1160634	self
https://bugzilla.suse.com/1167773	self
https://bugzilla.suse.com/1170139	self
https://bugzilla.suse.com/1171073	self
https://bugzilla.suse.com/1171558	self
https://bugzilla.suse.com/1172873	self
https://bugzilla.suse.com/1173504	self
https://bugzilla.suse.com/1174852	self
https://bugzilla.suse.com/1175721	self
https://bugzilla.suse.com/1175918	self
https://bugzilla.suse.com/1176109	self
https://bugzilla.suse.com/1176180	self
https://bugzilla.suse.com/1176200	self
https://bugzilla.suse.com/1176481	self
https://bugzilla.suse.com/1176586	self
https://bugzilla.suse.com/1176855	self
https://bugzilla.suse.com/1176983	self
https://bugzilla.suse.com/1177066	self
https://bugzilla.suse.com/1177070	self
https://bugzilla.suse.com/1177353	self
https://bugzilla.suse.com/1177397	self
https://bugzilla.suse.com/1177666	self
https://bugzilla.suse.com/1177703	self
https://bugzilla.suse.com/1177820	self
https://bugzilla.suse.com/1178182	self
https://bugzilla.suse.com/1178227	self
https://bugzilla.suse.com/1178286	self
https://bugzilla.suse.com/1178304	self
https://bugzilla.suse.com/1178401	self
https://bugzilla.suse.com/1178426	self
https://bugzilla.suse.com/1178589	self
https://bugzilla.suse.com/1178635	self
https://bugzilla.suse.com/1178653	self
https://bugzilla.suse.com/1178659	self
https://bugzilla.suse.com/1178661	self
https://bugzilla.suse.com/1178669	self
https://bugzilla.suse.com/1178686	self
https://bugzilla.suse.com/1178740	self
https://bugzilla.suse.com/1178755	self
https://bugzilla.suse.com/1178762	self
https://bugzilla.suse.com/1178782	self
https://bugzilla.suse.com/1178838	self
https://bugzilla.suse.com/1178853	self
https://bugzilla.suse.com/1178886	self
https://bugzilla.suse.com/1179001	self
https://bugzilla.suse.com/1179012	self
https://bugzilla.suse.com/1179014	self
https://bugzilla.suse.com/1179015	self
https://bugzilla.suse.com/1179045	self
https://bugzilla.suse.com/1179076	self
https://bugzilla.suse.com/1179082	self
https://bugzilla.suse.com/1179107	self
https://bugzilla.suse.com/1179140	self
https://bugzilla.suse.com/1179141	self
https://bugzilla.suse.com/1179160	self
https://bugzilla.suse.com/1179201	self
https://bugzilla.suse.com/1179211	self
https://bugzilla.suse.com/1179217	self
https://bugzilla.suse.com/1179424	self
https://bugzilla.suse.com/1179426	self
https://bugzilla.suse.com/1179427	self
https://bugzilla.suse.com/1179429	self
https://bugzilla.suse.com/1179432	self
https://www.suse.com/security/cve/CVE-2020-15436/	self
https://www.suse.com/security/cve/CVE-2020-15437/	self
https://www.suse.com/security/cve/CVE-2020-25669/	self
https://www.suse.com/security/cve/CVE-2020-25705/	self
https://www.suse.com/security/cve/CVE-2020-27777/	self
https://www.suse.com/security/cve/CVE-2020-28915/	self
https://www.suse.com/security/cve/CVE-2020-28941/	self
https://www.suse.com/security/cve/CVE-2020-28974/	self
https://www.suse.com/security/cve/CVE-2020-29369/	self
https://www.suse.com/security/cve/CVE-2020-29371/	self
https://www.suse.com/security/cve/CVE-2020-4788/	self
https://www.suse.com/security/cve/CVE-2020-15436	external
https://bugzilla.suse.com/1179141	external
https://www.suse.com/security/cve/CVE-2020-15437	external
https://bugzilla.suse.com/1179140	external
https://www.suse.com/security/cve/CVE-2020-25669	external
https://bugzilla.suse.com/1178182	external
https://www.suse.com/security/cve/CVE-2020-25705	external
https://bugzilla.suse.com/1175721	external
https://bugzilla.suse.com/1178782	external
https://bugzilla.suse.com/1178783	external
https://bugzilla.suse.com/1191790	external
https://www.suse.com/security/cve/CVE-2020-27777	external
https://bugzilla.suse.com/1179107	external
https://bugzilla.suse.com/1179419	external
https://bugzilla.suse.com/1200343	external
https://bugzilla.suse.com/1220060	external
https://www.suse.com/security/cve/CVE-2020-28915	external
https://bugzilla.suse.com/1178886	external
https://www.suse.com/security/cve/CVE-2020-28941	external
https://bugzilla.suse.com/1178740	external
https://www.suse.com/security/cve/CVE-2020-28974	external
https://bugzilla.suse.com/1178589	external
https://www.suse.com/security/cve/CVE-2020-29369	external
https://bugzilla.suse.com/1173504	external
https://bugzilla.suse.com/1179432	external
https://bugzilla.suse.com/1179646	external
https://bugzilla.suse.com/1182109	external
https://www.suse.com/security/cve/CVE-2020-29371	external
https://bugzilla.suse.com/1179429	external
https://www.suse.com/security/cve/CVE-2020-4788	external
https://bugzilla.suse.com/1177666	external
https://bugzilla.suse.com/1181158	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\n\nThe openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2020-29369: There was a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bnc#1179432).\n- CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c, where uninitialized memory could leak to userspace, aka CID-bcf85fcedfdd (bnc#1179429).\n- CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c allowed local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field (bnc#1179141).\n- CVE-2020-25705: A flaw in the way reply ICMP packets are limited was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Kernel versions may be vulnerable to this issue (bnc#1175721 bnc#1178782).\n- CVE-2020-15437: The Linux kernel was vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allowed local users to cause a denial of service by using the p-\u003eserial_in pointer which uninitialized (bnc#1179140).\n- CVE-2020-27777: Restricted RTAS requests from userspace  (bsc#1179107). \n- CVE-2020-28974: A slab-out-of-bounds read in fbcon could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height (bnc#1178589).\n- CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#1177666).\n- CVE-2020-28941: Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once (bnc#1178740).\n- CVE-2020-28915: A buffer over-read (at the framebuffer layer) in the fbcon code could be used by local attackers to read kernel memory, aka CID-6735b4632def (bnc#1178886).\n- CVE-2020-25669: Avoid a use-after-free in teardown paths in sunkbd (bsc#1178182).\n\nThe following non-security bugs were fixed:\n\n- 9P: Cast to loff_t before multiplying (git-fixes).\n- ACPI: GED: fix -Wformat (git-fixes).\n- ACPI: NFIT: Fix comparison to \u0027-ENXIO\u0027 (git-fixes).\n- ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).\n- ACPI: dock: fix enum-conversion warning (git-fixes).\n- ACPICA: Add NHLT table signature (bsc#1176200).\n- ALSA: ctl: fix error path at adding user-defined element set (git-fixes).\n- ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).\n- ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).\n- ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).\n- ALSA: hda/realtek - HP Headset Mic can\u0027t detect after boot (git-fixes).\n- ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).\n- ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).\n- ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).\n- ALSA: mixart: Fix mutex deadlock (git-fixes).\n- ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).\n- ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).\n- Add bug reference to two hv_netvsc patches (bsc#1178853).\n- Convert trailing spaces and periods in path components (bsc#1179424).\n- Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU (bsc#1177353, bsc#1179076).\n- Drop sysctl files for dropped archs, add ppc64le and arm (bsc#1178838). Also correct the page size on ppc64.\n- EDAC/amd64: Cache secondary Chip Select registers (bsc#1179001).\n- EDAC/amd64: Find Chip Select memory size using Address Mask (bsc#1179001).\n- EDAC/amd64: Gather hardware information early (bsc#1179001).\n- EDAC/amd64: Initialize DIMM info for systems with more than two channels (bsc#1179001).\n- EDAC/amd64: Make struct amd64_family_type global (bsc#1179001).\n- EDAC/amd64: Save max number of controllers to family type (bsc#1179001).\n- EDAC/amd64: Support asymmetric dual-rank DIMMs (bsc#1179001).\n- Fix wrongly set CONFIG_SOUNDWIRE=y (bsc#1179201) CONFIG_SOUNDWIRE was mistakenly set as built-in. Mark it as module.\n- HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver (git-fixes).\n- HID: logitech-dj: Fix an error in mse_bluetooth_descriptor (git-fixes).\n- HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad (git-fixes).\n- HID: logitech-hidpp: Add PID for MX Anywhere 2 (git-fixes).\n- Input: adxl34x - clean up a data type in adxl34x_probe() (git-fixes).\n- Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER (git-fixes).\n- KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 does not return SMCCC_RET_NOT_REQUIRED (git-fixes).\n- NFS: only invalidate dentrys that are clearly invalid (bsc#1178669 bsc#1170139).\n- NFSv4.x recover from pre-mature loss of openstateid (bsc#1176180).\n- NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE (bsc#1176180).\n- NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE (bsc#1176180).\n- RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP (jsc#SLE-8449).\n- RDMA/hns: Fix the wrong value of rnr_retry when querying qp (jsc#SLE-8449).\n- RDMA/hns: Fix wrong field of SRQ number the device supports (jsc#SLE-8449).\n- RDMA/hns: Solve the overflow of the calc_pg_sz() (jsc#SLE-8449).\n- RDMA/mlx5: Fix devlink deadlock on net namespace deletion (jsc#SLE-8464).\n- RDMA/qedr: Fix return code if accept is called on a destroyed qp (jsc#SLE-8215).\n- RDMA/ucma: Add missing locking around rdma_leave_multicast() (git-fixes).\n- Revert \u0027cdc-acm: hardening against malicious devices\u0027 (git-fixes).\n- Revert \u0027kernel/reboot.c: convert simple_strtoul to kstrtoint\u0027 (git-fixes).\n- SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow() (git-fixes).\n- SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (bsc#1154353).\n- USB: Add NO_LPM quirk for Kingston flash drive (git-fixes).\n- USB: core: Change %pK for __user pointers to %px (git-fixes).\n- USB: core: Fix regression in Hercules audio card (git-fixes).\n- USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 (git-fixes).\n- USB: serial: option: add Quectel EC200T module support (git-fixes).\n- USB: serial: option: add Telit FN980 composition 0x1055 (git-fixes).\n- arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs (git-fixes).\n- arm64: Run ARCH_WORKAROUND_2 enabling code on all CPUs (git-fixes).\n- arm64: bpf: Fix branch offset in JIT (git-fixes).\n- arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay (git-fixes).\n- arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node (git-fixes).\n- arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node (git-fixes).\n- arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY (git-fixes).\n- arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay (git-fixes).\n- arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node (git-fixes).\n- arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node (git-fixes).\n- arm64: dts: fsl: DPAA FMan DMA operations are coherent (git-fixes).\n- arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point (git-fixes).\n- arm64: dts: imx8mq: Add missing interrupts to GPC (git-fixes).\n- arm64: dts: imx8mq: Fix TMU interrupt property (git-fixes).\n- arm64: dts: zynqmp: Remove additional compatible string for i2c IPs (git-fixes).\n- arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions (git-fixes).\n- arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes (git-fixes).\n- arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes (git-fixes).\n- arm64: tegra: Add missing timeout clock to Tegra210 SDMMC (git-fixes).\n- arm64: vdso: Add \u0027-Bsymbolic\u0027 to ldflags (git-fixes).\n- arm64: vdso: Add --eh-frame-hdr to ldflags (git-fixes).\n- batman-adv: set .owner to THIS_MODULE (git-fixes).\n- bnxt_en: Avoid sending firmware messages when AER error is detected (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Check abort error state in bnxt_open_nic() (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task() (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Fix regression in workqueue cleanup logic in bnxt_remove_one() (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Invoke cancel_delayed_work_sync() for PFs also (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Send HWRM_FUNC_RESET fw command unconditionally (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: return proper error codes in bnxt_show_temp (git-fixes).\n- bpf: Do not rely on GCC __attribute__((optimize)) to disable GCSE (bsc#1155518).\n- bpf: Fix comment for helper bpf_current_task_under_cgroup() (bsc#1155518).\n- bpf: Zero-fill re-used per-cpu map element (bsc#1155518).\n- btrfs: fix bytes_may_use underflow in prealloc error condtition (bsc#1179217).\n- btrfs: fix metadata reservation for fallocate that leads to transaction aborts (bsc#1179217).\n- btrfs: fix relocation failure due to race with fallocate (bsc#1179217).\n- btrfs: remove item_size member of struct btrfs_clone_extent_info (bsc#1179217).\n- btrfs: rename btrfs_insert_clone_extent() to a more generic name (bsc#1179217).\n- btrfs: rename btrfs_punch_hole_range() to a more generic name (bsc#1179217).\n- btrfs: rename struct btrfs_clone_extent_info to a more generic name (bsc#1179217).\n- can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).\n- can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).\n- can: dev: can_restart(): post buffer from the right context (git-fixes).\n- can: flexcan: flexcan_setup_stop_mode(): add missing \u0027req_bit\u0027 to stop mode property comment (git-fixes).\n- can: gs_usb: fix endianess problem with candleLight firmware (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits (git-fixes).\n- can: m_can: fix nominal bitiming tseg2 min for version \u003e= 3.1 (git-fixes).\n- can: m_can: m_can_handle_state_change(): fix state change (git-fixes).\n- can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes).\n- can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes).\n- can: peak_usb: fix potential integer overflow on shift of a int (git-fixes).\n- ceph: add check_session_state() helper and make it global (bsc#1179012).\n- ceph: check session state after bumping session-\u003es_seq (bsc#1179012).\n- ceph: check the sesion state and return false in case it is closed (bsc#1179012).\n- ceph: downgrade warning from mdsmap decode to debug (bsc#1178653).\n- ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635).\n- cfg80211: initialize wdev data earlier (git-fixes).\n- cfg80211: regulatory: Fix inconsistent format argument (git-fixes).\n- cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211).\n- cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426).\n- cifs: remove bogus debug code (bsc#1179427).\n- clk: define to_clk_regmap() as inline function (git-fixes).\n- cosa: Add missing kfree in error path of cosa_write (git-fixes).\n- dax: Fix stack overflow when mounting fsdax pmem device (bsc#1171073).\n- dax: fix detection of dax support for non-persistent memory block devices (bsc#1171073).\n- devlink: Make sure devlink instance and port are in same net namespace (bsc#1154353).\n- docs: ABI: sysfs-c2port: remove a duplicated entry (git-fixes).\n- drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873).\n- drivers/net/ethernet: remove incorrectly formatted doc (bsc#1177397).\n- efi/efivars: Set generic ops before loading SSDT (git-fixes).\n- efi/esrt: Fix reference count leak in esre_create_sysfs_entry (git-fixes).\n- efi/libstub/x86: Work around LLVM ELF quirk build regression (git-fixes).\n- efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper (git-fixes).\n- efi/x86: Do not panic or BUG() on non-critical error conditions (git-fixes).\n- efi/x86: Fix the deletion of variables in mixed mode (git-fixes).\n- efi/x86: Free efi_pgd with free_pages() (git-fixes).\n- efi/x86: Handle by-ref arguments covering multiple pages in mixed mode (git-fixes).\n- efi/x86: Ignore the memory attributes table on i386 (git-fixes).\n- efi/x86: Map the entire EFI vendor string before copying it (git-fixes).\n- efi: EFI_EARLYCON should depend on EFI (git-fixes).\n- efi: add missed destroy_workqueue when efisubsys_init fails (git-fixes).\n- efi: efibc: check for efivars write capability (git-fixes).\n- efi: provide empty efi_enter_virtual_mode implementation (git-fixes).\n- efivarfs: fix memory leak in efivarfs_create() (git-fixes).\n- efivarfs: revert \u0027fix memory leak in efivarfs_create()\u0027 (git-fixes).\n- fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h (git-fixes).\n- ftrace: Fix recursion check for NMI test (git-fixes).\n- ftrace: Handle tracing when switching between context (git-fixes).\n- futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1149032).\n- futex: Handle transient \u0027ownerless\u0027 rtmutex state correctly (bsc#1149032).\n- gpio: pcie-idio-24: Enable PEX8311 interrupts (git-fixes).\n- gpio: pcie-idio-24: Fix IRQ Enable Register value (git-fixes).\n- gpio: pcie-idio-24: Fix irq mask when masking (git-fixes).\n- hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() functions (git-fixes).\n- hv_balloon: disable warning when floor reached (git-fixes).\n- hv_netvsc: Add XDP support (bsc#1177820).\n- hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177820).\n- hv_netvsc: make recording RSS hash depend on feature flag (bsc#1177820).\n- hv_netvsc: record hardware hash in skb (bsc#1177820).\n- hwmon: (pwm-fan) Fix RPM calculation (git-fixes).\n- i2c: mediatek: move dma reset before i2c reset (git-fixes).\n- i2c: sh_mobile: implement atomic transfers (git-fixes).\n- igc: Fix not considering the TX delay for timestamps (bsc#1160634).\n- igc: Fix wrong timestamp latency numbers (bsc#1160634).\n- iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (git-fixes).\n- iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (git-fixes).\n- iio: adc: mediatek: fix unset field (git-fixes).\n- iio: light: fix kconfig dependency bug for VCNL4035 (git-fixes).\n- intel_idle: Customize IceLake server support (bsc#1178286).\n- ionic: check port ptr before use (bsc#1167773).\n- iwlwifi: mvm: write queue_sync_state only for sync (git-fixes).\n- kABI workaround for HD-audio (git-fixes).\n- kABI: revert use_mm name change (MM Functionality, bsc#1178426).\n- kernel-source.spec: Fix build with rpm 4.16 (boo#1179015).\n- kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082)\n- kernel/watchdog: fix watchdog_allowed_mask not used warning (git-fixes).\n- kernel: better document the use_mm/unuse_mm API contract (MM Functionality, bsc#1178426).\n- kgdb: Fix spurious true from in_dbg_master() (git-fixes).\n- kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled (git-fixes).\n- lan743x: fix \u0027BUG: invalid wait context\u0027 when setting rx mode (git-fixes).\n- lan743x: fix issue causing intermittent kernel log warnings (git-fixes).\n- lan743x: prevent entire kernel HANG on open, for some platforms (git-fixes).\n- lib/crc32test: remove extra local_irq_disable/enable (git-fixes).\n- lib/strncpy_from_user.c: Mask out bytes after NUL terminator (bsc#1155518).\n- libbpf, hashmap: Fix undefined behavior in hash_bits (bsc#1155518).\n- libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873).\n- libnvdimm/nvdimm/flush: Allow architecture to override the flush barrier (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- mac80211: always wind down STA state (git-fixes).\n- mac80211: fix use of skb payload instead of header (git-fixes).\n- mac80211: free sta in sta_info_insert_finish() on errors (git-fixes).\n- mac80211: minstrel: fix tx status processing corner case (git-fixes).\n- mac80211: minstrel: remove deferred sampling code (git-fixes).\n- mei: protect mei_cl_mtu from null dereference (git-fixes).\n- memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event (bsc#1177703).\n- mfd: sprd: Add wakeup capability for PMIC IRQ (git-fixes).\n- mm, THP, swap: fix allocating cluster for swapfile by mistake (bsc#1178755).\n- mm, memcg: fix inconsistent oom event behavior (bsc#1178659).\n- mm/gup: allow FOLL_FORCE for get_user_pages_fast() (git fixes (mm/gup)).\n- mm/gup: fix gup_fast with dynamic page table folding (bnc#1176586, LTC#188235).\n- mm/ksm: fix NULL pointer dereference when KSM zero page is enabled (git fixes (mm/ksm)).\n- mm/memcg: fix refcount error while moving and swapping (bsc#1178686).\n- mm/memcontrol.c: add missed css_put() (bsc#1178661).\n- mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race (MM Functionality, bsc#1178426).\n- mm: fix kthread_use_mm() vs TLB invalidate (MM Functionality, bsc#1178426).\n- mm: mempolicy: require at least one nodeid for MPOL_PREFERRED (git fixes (mm/mempolicy)).\n- mm: swap: make page_evictable() inline (git fixes (mm/vmscan)).\n- mm: swap: use smp_mb__after_atomic() to order LRU bit set (git fixes (mm/vmscan)).\n- mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove (git-fixes).\n- mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs (git-fixes).\n- mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers (git-fixes).\n- modsign: Add codeSigning EKU when generating X.509 key generation config (bsc#1177353, bsc#1179076).\n- net/mlx5: Clear bw_share upon VF disable (jsc#SLE-8464).\n- net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled (jsc#SLE-8464).\n- net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send (bsc#1172873).\n- net: ena: Capitalize all log strings and improve code readability (bsc#1177397).\n- net: ena: Change RSS related macros and variables names (bsc#1177397).\n- net: ena: Change license into format to SPDX in all files (bsc#1177397).\n- net: ena: Change log message to netif/dev function (bsc#1177397).\n- net: ena: Fix all static chekers\u0027 warnings (bsc#1177397).\n- net: ena: Remove redundant print of placement policy (bsc#1177397).\n- net: ena: ethtool: Add new device statistics (bsc#1177397).\n- net: ena: ethtool: add stats printing to XDP queues (bsc#1177397).\n- net: ena: ethtool: convert stat_offset to 64 bit resolution (bsc#1177397).\n- net: ena: fix packet\u0027s addresses for rx_offset feature (bsc#1174852).\n- net: ena: handle bad request id in ena_netdev (bsc#1174852).\n- net: ena: xdp: add queue counters for xdp actions (bsc#1177397).\n- net: fix pos incrementment in ipv6_route_seq_next (bsc#1154353).\n- net: introduce helper sendpage_ok() in include/linux/net.h (bsc#1172873).\n- net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition (git-fixes).\n- nfc: s3fwrn5: use signed integer for parsing GPIO numbers (git-fixes).\n- nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() (bsc#1172873).\n- nvme: do not update disk info for multipathed device (bsc#1171558).\n- pinctrl: amd: fix incorrect way to disable debounce filter (git-fixes).\n- pinctrl: amd: use higher precision for 512 RtcClk (git-fixes).\n- pinctrl: aspeed: Fix GPI only function problem (git-fixes).\n- pinctrl: intel: Set default bias in case no particular value given (git-fixes).\n- platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time (git-fixes).\n- platform/x86: toshiba_acpi: Fix the wrong variable assignment (git-fixes).\n- powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm (MM Functionality, bsc#1178426).\n- powerpc/perf: consolidate GPCI hcall structs into asm/hvcall.h (jsc#SLE-16360 jsc#SLE-16915).\n- powerpc/pmem: Add flush routines using new pmem store and sync instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Add new instructions for persistent storage and sync (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Avoid the barrier in flush routines (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Initialize pmem device on newer hardware (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Restrict papr_scm to P8 and above (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Update ppc64 to use the new barrier instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pseries: Add KVM guest doorbell restrictions (jsc#SLE-15869 jsc#SLE-16321).\n- powerpc/pseries: Use doorbells even if XIVE is available (jsc#SLE-15869 jsc#SLE-16321).\n- powerpc/pseries: new lparcfg key/value pair: partition_affinity_score (jsc#SLE-16360 jsc#SLE-16915).\n- powerpc/vnic: Extend \u0027failover pending\u0027 window (bsc#1176855 ltc#187293).\n- powerpc: Inline doorbell sending functions (jsc#SLE-15869 jsc#SLE-16321).\n- powerpc: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM (MM Functionality, bsc#1178426).\n- qla2xxx: Add MODULE_VERSION back to driver (bsc#1179160).\n- reboot: fix overflow parsing reboot cpu number (git-fixes).\n- regulator: avoid resolve_supply() infinite recursion (git-fixes).\n- regulator: fix memory leak with repeated set_machine_constraints() (git-fixes).\n- regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} (git-fixes).\n- regulator: ti-abb: Fix array out of bound read access on the first transition (git-fixes).\n- regulator: workaround self-referent regulators (git-fixes).\n- rfkill: Fix use-after-free in rfkill_resume() (git-fixes).\n- ring-buffer: Fix recursion protection transitions between interrupt context (git-fixes).\n- rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014)\n- rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014)\n- rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045)\n- rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401)\n- rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).\n- rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one).\n- s390/bpf: Fix multiple tail calls (git-fixes).\n- s390/cpum_cf,perf: change DFLT_CCERROR counter name (bsc#1175918 LTC#187935).\n- s390/cpum_sf.c: fix file permission for cpum_sfb_size (git-fixes).\n- s390/dasd: fix null pointer dereference for ERP requests (git-fixes).\n- s390/pkey: fix paes selftest failure with paes and pkey static build (git-fixes).\n- s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl (bsc#1177070 LTC#188342).\n- s390/zcrypt: fix kmalloc 256k failure (bsc#1177066 LTC#188341).\n- sched/fair: Ensure tasks spreading in LLC during LB (git fixes (sched)).\n- sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list (git fixes (sched)).\n- sched: Fix loadavg accounting race on arm64 kabi (bnc#1178227).\n- sched: Fix rq-\u003enr_iowait ordering (git fixes (sched)).\n- scripts/lib/SUSE/MyBS.pm: properly close prjconf Macros: section\n- scsi: libiscsi: Fix NOP race condition (bsc#1176481).\n- scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() (bsc#1172873).\n- spi: lpspi: Fix use-after-free on unbind (git-fixes).\n- staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (git-fixes).\n- svcrdma: fix bounce buffers for unaligned offsets and multiple pages (git-fixes).\n- tcp: use sendpage_ok() to detect misused .sendpage (bsc#1172873).\n- thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() (git-fixes).\n- thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() (git-fixes).\n- timer: Fix wheel index calculation on last level (git-fixes).\n- timer: Prevent base-\u003eclk from moving backward (git-fixes).\n- tpm: efi: Do not create binary_bios_measurements file for an empty log (git-fixes).\n- tpm_tis: Disable interrupts on ThinkPad T490s (git-fixes).\n- tracing: Fix out of bounds write in get_trace_buf (git-fixes).\n- tty: serial: fsl_lpuart: LS1021A had a FIFO size of 16 words, like LS1028A (git-fixes).\n- tty: serial: fsl_lpuart: add LS1028A support (git-fixes).\n- tty: serial: imx: fix potential deadlock (git-fixes).\n- tty: serial: imx: keep console clocks always on (git-fixes).\n- uio: Fix use-after-free in uio_unregister_device() (git-fixes).\n- usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (git-fixes).\n- usb: core: driver: fix stray tabs in error messages (git-fixes).\n- usb: gadget: Fix memleak in gadgetfs_fill_super (git-fixes).\n- usb: gadget: f_midi: Fix memleak in f_midi_alloc (git-fixes).\n- usb: gadget: goku_udc: fix potential crashes in probe (git-fixes).\n- usb: host: fsl-mph-dr-of: check return of dma_set_mask() (git-fixes).\n- usb: typec: tcpm: reset hard_reset_count for any disconnect (git-fixes).\n- video: hyperv_fb: Fix the cache type when mapping the VRAM (git-fixes).\n- video: hyperv_fb: include vmalloc.h (git-fixes).\n- virtio: virtio_console: fix DMA memory allocation for rproc serial (git-fixes).\n- vt: Disable KD_FONT_OP_COPY (bsc#1178589).\n- x86/hyperv: Clarify comment on x2apic mode (git-fixes).\n- x86/i8259: Use printk_deferred() to prevent deadlock (git-fixes).\n- x86/microcode/intel: Check patch signature before saving microcode for early loading (bsc#1152489).\n- x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (bsc#1152489).\n- xfs: fix a missing unlock on error in xfs_fs_map_blocks (git-fixes).\n- xfs: fix brainos in the refcount scrubber\u0027s rmap fragment processor (git-fixes).\n- xfs: fix flags argument to rmap lookup when converting shared file rmaps (git-fixes).\n- xfs: fix rmap key and record comparison functions (git-fixes).\n- xfs: revert \u0027xfs: fix rmap key and record comparison functions\u0027 (git-fixes).\n- xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents (git-fixes).\n- xhci: Fix sizeof() mismatch (git-fixes).\n- xhci: hisilicon: fix refercence leak in xhci_histb_probe (git-fixes).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-2161",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_2161-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:2161-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ICEKZTGIQ6MSKDFOTIOJ2RLWAWJFPSYA/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:2161-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ICEKZTGIQ6MSKDFOTIOJ2RLWAWJFPSYA/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1149032",
        "url": "https://bugzilla.suse.com/1149032"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1152489",
        "url": "https://bugzilla.suse.com/1152489"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1153274",
        "url": "https://bugzilla.suse.com/1153274"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1154353",
        "url": "https://bugzilla.suse.com/1154353"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1155518",
        "url": "https://bugzilla.suse.com/1155518"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1160634",
        "url": "https://bugzilla.suse.com/1160634"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1167773",
        "url": "https://bugzilla.suse.com/1167773"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1170139",
        "url": "https://bugzilla.suse.com/1170139"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1171073",
        "url": "https://bugzilla.suse.com/1171073"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1171558",
        "url": "https://bugzilla.suse.com/1171558"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172873",
        "url": "https://bugzilla.suse.com/1172873"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1173504",
        "url": "https://bugzilla.suse.com/1173504"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1174852",
        "url": "https://bugzilla.suse.com/1174852"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1175721",
        "url": "https://bugzilla.suse.com/1175721"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1175918",
        "url": "https://bugzilla.suse.com/1175918"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176109",
        "url": "https://bugzilla.suse.com/1176109"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176180",
        "url": "https://bugzilla.suse.com/1176180"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176200",
        "url": "https://bugzilla.suse.com/1176200"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176481",
        "url": "https://bugzilla.suse.com/1176481"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176586",
        "url": "https://bugzilla.suse.com/1176586"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176855",
        "url": "https://bugzilla.suse.com/1176855"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176983",
        "url": "https://bugzilla.suse.com/1176983"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177066",
        "url": "https://bugzilla.suse.com/1177066"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177070",
        "url": "https://bugzilla.suse.com/1177070"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177353",
        "url": "https://bugzilla.suse.com/1177353"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177397",
        "url": "https://bugzilla.suse.com/1177397"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177666",
        "url": "https://bugzilla.suse.com/1177666"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177703",
        "url": "https://bugzilla.suse.com/1177703"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177820",
        "url": "https://bugzilla.suse.com/1177820"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178182",
        "url": "https://bugzilla.suse.com/1178182"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178227",
        "url": "https://bugzilla.suse.com/1178227"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178286",
        "url": "https://bugzilla.suse.com/1178286"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178304",
        "url": "https://bugzilla.suse.com/1178304"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178401",
        "url": "https://bugzilla.suse.com/1178401"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178426",
        "url": "https://bugzilla.suse.com/1178426"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178589",
        "url": "https://bugzilla.suse.com/1178589"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178635",
        "url": "https://bugzilla.suse.com/1178635"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178653",
        "url": "https://bugzilla.suse.com/1178653"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178659",
        "url": "https://bugzilla.suse.com/1178659"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178661",
        "url": "https://bugzilla.suse.com/1178661"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178669",
        "url": "https://bugzilla.suse.com/1178669"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178686",
        "url": "https://bugzilla.suse.com/1178686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178740",
        "url": "https://bugzilla.suse.com/1178740"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178755",
        "url": "https://bugzilla.suse.com/1178755"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178762",
        "url": "https://bugzilla.suse.com/1178762"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178782",
        "url": "https://bugzilla.suse.com/1178782"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178838",
        "url": "https://bugzilla.suse.com/1178838"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178853",
        "url": "https://bugzilla.suse.com/1178853"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178886",
        "url": "https://bugzilla.suse.com/1178886"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179001",
        "url": "https://bugzilla.suse.com/1179001"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179012",
        "url": "https://bugzilla.suse.com/1179012"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179014",
        "url": "https://bugzilla.suse.com/1179014"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179015",
        "url": "https://bugzilla.suse.com/1179015"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179045",
        "url": "https://bugzilla.suse.com/1179045"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179076",
        "url": "https://bugzilla.suse.com/1179076"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179082",
        "url": "https://bugzilla.suse.com/1179082"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179107",
        "url": "https://bugzilla.suse.com/1179107"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179140",
        "url": "https://bugzilla.suse.com/1179140"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179141",
        "url": "https://bugzilla.suse.com/1179141"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179160",
        "url": "https://bugzilla.suse.com/1179160"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179201",
        "url": "https://bugzilla.suse.com/1179201"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179211",
        "url": "https://bugzilla.suse.com/1179211"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179217",
        "url": "https://bugzilla.suse.com/1179217"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179424",
        "url": "https://bugzilla.suse.com/1179424"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179426",
        "url": "https://bugzilla.suse.com/1179426"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179427",
        "url": "https://bugzilla.suse.com/1179427"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179429",
        "url": "https://bugzilla.suse.com/1179429"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179432",
        "url": "https://bugzilla.suse.com/1179432"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15436 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15436/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15437 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15437/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25669 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25669/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25705 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25705/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27777 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27777/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28915 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28915/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28941 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28941/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28974 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28974/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-29369 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-29369/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-29371 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-29371/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-4788 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-4788/"
      }
    ],
    "title": "Security update for the Linux Kernel",
    "tracking": {
      "current_release_date": "2020-12-04T22:35:01Z",
      "generator": {
        "date": "2020-12-04T22:35:01Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:2161-1",
      "initial_release_date": "2020-12-04T22:35:01Z",
      "revision_history": [
        {
          "date": "2020-12-04T22:35:01Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-5.3.18-lp152.54.1.noarch",
                "product": {
                  "name": "kernel-devel-5.3.18-lp152.54.1.noarch",
                  "product_id": "kernel-devel-5.3.18-lp152.54.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-docs-5.3.18-lp152.54.2.noarch",
                "product": {
                  "name": "kernel-docs-5.3.18-lp152.54.2.noarch",
                  "product_id": "kernel-docs-5.3.18-lp152.54.2.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-docs-html-5.3.18-lp152.54.2.noarch",
                "product": {
                  "name": "kernel-docs-html-5.3.18-lp152.54.2.noarch",
                  "product_id": "kernel-docs-html-5.3.18-lp152.54.2.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-macros-5.3.18-lp152.54.1.noarch",
                "product": {
                  "name": "kernel-macros-5.3.18-lp152.54.1.noarch",
                  "product_id": "kernel-macros-5.3.18-lp152.54.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-5.3.18-lp152.54.1.noarch",
                "product": {
                  "name": "kernel-source-5.3.18-lp152.54.1.noarch",
                  "product_id": "kernel-source-5.3.18-lp152.54.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
                "product": {
                  "name": "kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
                  "product_id": "kernel-source-vanilla-5.3.18-lp152.54.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-debug-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-debug-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-debug-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-debug-devel-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-default-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-default-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
                "product": {
                  "name": "kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
                  "product_id": "kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
                "product": {
                  "name": "kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
                  "product_id": "kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-devel-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-default-devel-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-default-devel-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-kvmsmall-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-obs-build-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-obs-build-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-obs-build-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-obs-qa-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-preempt-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-preempt-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-preempt-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-preempt-devel-5.3.18-lp152.54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-syms-5.3.18-lp152.54.1.x86_64",
                "product": {
                  "name": "kernel-syms-5.3.18-lp152.54.1.x86_64",
                  "product_id": "kernel-syms-5.3.18-lp152.54.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-debug-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-devel-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-default-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64"
        },
        "product_reference": "kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64"
        },
        "product_reference": "kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-devel-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-default-devel-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-5.3.18-lp152.54.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch"
        },
        "product_reference": "kernel-devel-5.3.18-lp152.54.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-docs-5.3.18-lp152.54.2.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch"
        },
        "product_reference": "kernel-docs-5.3.18-lp152.54.2.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-docs-html-5.3.18-lp152.54.2.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch"
        },
        "product_reference": "kernel-docs-html-5.3.18-lp152.54.2.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-kvmsmall-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-macros-5.3.18-lp152.54.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch"
        },
        "product_reference": "kernel-macros-5.3.18-lp152.54.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-obs-build-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-obs-build-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-obs-qa-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-preempt-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-preempt-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-preempt-devel-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-5.3.18-lp152.54.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch"
        },
        "product_reference": "kernel-source-5.3.18-lp152.54.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-vanilla-5.3.18-lp152.54.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch"
        },
        "product_reference": "kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-syms-5.3.18-lp152.54.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        },
        "product_reference": "kernel-syms-5.3.18-lp152.54.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15436",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15436"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15436",
          "url": "https://www.suse.com/security/cve/CVE-2020-15436"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179141 for CVE-2020-15436",
          "url": "https://bugzilla.suse.com/1179141"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15436"
    },
    {
      "cve": "CVE-2020-15437",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15437"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p-\u003eserial_in pointer which uninitialized.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15437",
          "url": "https://www.suse.com/security/cve/CVE-2020-15437"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179140 for CVE-2020-15437",
          "url": "https://bugzilla.suse.com/1179140"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15437"
    },
    {
      "cve": "CVE-2020-25669",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25669"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25669",
          "url": "https://www.suse.com/security/cve/CVE-2020-25669"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178182 for CVE-2020-25669",
          "url": "https://bugzilla.suse.com/1178182"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25669"
    },
    {
      "cve": "CVE-2020-25705",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25705"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25705",
          "url": "https://www.suse.com/security/cve/CVE-2020-25705"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1175721 for CVE-2020-25705",
          "url": "https://bugzilla.suse.com/1175721"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178782 for CVE-2020-25705",
          "url": "https://bugzilla.suse.com/1178782"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178783 for CVE-2020-25705",
          "url": "https://bugzilla.suse.com/1178783"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191790 for CVE-2020-25705",
          "url": "https://bugzilla.suse.com/1191790"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-25705"
    },
    {
      "cve": "CVE-2020-27777",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27777"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27777",
          "url": "https://www.suse.com/security/cve/CVE-2020-27777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179107 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1179107"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179419 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1179419"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200343 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1200343"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1220060 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1220060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27777"
    },
    {
      "cve": "CVE-2020-28915",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28915"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28915",
          "url": "https://www.suse.com/security/cve/CVE-2020-28915"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178886 for CVE-2020-28915",
          "url": "https://bugzilla.suse.com/1178886"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-28915"
    },
    {
      "cve": "CVE-2020-28941",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28941"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28941",
          "url": "https://www.suse.com/security/cve/CVE-2020-28941"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178740 for CVE-2020-28941",
          "url": "https://bugzilla.suse.com/1178740"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-28941"
    },
    {
      "cve": "CVE-2020-28974",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28974"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28974",
          "url": "https://www.suse.com/security/cve/CVE-2020-28974"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178589 for CVE-2020-28974",
          "url": "https://bugzilla.suse.com/1178589"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-28974"
    },
    {
      "cve": "CVE-2020-29369",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-29369"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-29369",
          "url": "https://www.suse.com/security/cve/CVE-2020-29369"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173504 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1173504"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179432 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1179432"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179646 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1179646"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182109 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1182109"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-29369"
    },
    {
      "cve": "CVE-2020-29371",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-29371"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-29371",
          "url": "https://www.suse.com/security/cve/CVE-2020-29371"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179429 for CVE-2020-29371",
          "url": "https://bugzilla.suse.com/1179429"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-29371"
    },
    {
      "cve": "CVE-2020-4788",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-4788"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
          "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
          "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
          "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-4788",
          "url": "https://www.suse.com/security/cve/CVE-2020-4788"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177666 for CVE-2020-4788",
          "url": "https://bugzilla.suse.com/1177666"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181158 for CVE-2020-4788",
          "url": "https://bugzilla.suse.com/1181158"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-debug-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-debug-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.54.1.lp152.8.12.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-devel-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-docs-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-docs-html-5.3.18-lp152.54.2.noarch",
            "openSUSE Leap 15.2:kernel-kvmsmall-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-kvmsmall-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-macros-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-obs-build-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-obs-qa-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-preempt-devel-5.3.18-lp152.54.1.x86_64",
            "openSUSE Leap 15.2:kernel-source-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-source-vanilla-5.3.18-lp152.54.1.noarch",
            "openSUSE Leap 15.2:kernel-syms-5.3.18-lp152.54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T22:35:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-4788"
    }
  ]
}

OPENSUSE-SU-2020:2193-1

Vulnerability from csaf_opensuse - Published: 2020-12-07 11:06 - Updated: 2020-12-07 11:06

Summary

Security update for the Linux Kernel

Severity

Important

Notes

Title of the patch: Security update for the Linux Kernel

Description of the patch: The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c where uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd (bnc#1179429). - CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c allowed local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field (bnc#1179141). - CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#1177666). - CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c, where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971). - CVE-2020-15437: The Linux kernel was vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allowed local users to cause a denial of service by using the p->serial_in pointer which uninitialized (bnc#1179140). - CVE-2020-27777: Restrict RTAS requests from userspace (CVE-2020-27777 bsc#1179107). - CVE-2020-28974: A slab-out-of-bounds read in fbcon could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height (bnc#1178589). The following non-security bugs were fixed: - ACPI: GED: fix -Wformat (git-fixes). - ALSA: ctl: fix error path at adding user-defined element set (git-fixes). - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes). - ALSA: mixart: Fix mutex deadlock (git-fixes). - ASoC: qcom: lpass-platform: Fix memory leak (git-fixes). - Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes). - Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes). - Convert trailing spaces and periods in path components (bsc#1179424). - Drivers: hv: vmbus: Remove the unused 'tsc_page' from struct hv_context (git-fixes). - IB/cma: Fix ports memory leak in cma_configfs (bsc#1111666) - IB/core: Set qp->real_qp before it may be accessed (bsc#1111666) - IB/hfi1, qib: Ensure RCU is locked when accessing list (bsc#1111666) - IB/hfi1: Add RcvShortLengthErrCnt to hfi1stats (bsc#1111666) - IB/hfi1: Add missing INVALIDATE opcodes for trace (bsc#1111666) - IB/hfi1: Add software counter for ctxt0 seq drop (bsc#1111666) - IB/hfi1: Avoid hardlockup with flushlist_lock (bsc#1111666) - IB/hfi1: Call kobject_put() when kobject_init_and_add() fails (bsc#1111666) - IB/hfi1: Check for error on call to alloc_rsm_map_table (bsc#1111666) - IB/hfi1: Close PSM sdma_progress sleep window (bsc#1111666) - IB/hfi1: Define variables as unsigned long to fix KASAN warning (bsc#1111666) - IB/hfi1: Ensure full Gen3 speed in a Gen4 system (bsc#1111666) - IB/hfi1: Fix Spectre v1 vulnerability (bsc#1111666) - IB/hfi1: Fix memory leaks in sysfs registration and unregistration (bsc#1111666) - IB/hfi1: Handle port down properly in pio (bsc#1111666) - IB/hfi1: Handle wakeup of orphaned QPs for pio (bsc#1111666) - IB/hfi1: Insure freeze_work work_struct is canceled on shutdown (bsc#1111666) - IB/hfi1: Remove unused define (bsc#1111666) - IB/hfi1: Silence txreq allocation warnings (bsc#1111666) - IB/hfi1: Validate page aligned for a given virtual address (bsc#1111666) - IB/hfi1: Wakeup QPs orphaned on wait list after flush (bsc#1111666) - IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode (bsc#1111666) - IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start (bsc#1111666) - IB/ipoib: drop useless LIST_HEAD (bsc#1111666) - IB/iser: Fix dma_nents type definition (bsc#1111666) - IB/iser: Pass the correct number of entries for dma mapped SGL (bsc#1111666) - IB/mad: Fix use-after-free in ib mad completion handling (bsc#1111666) - IB/mlx4: Add and improve logging (bsc#1111666) - IB/mlx4: Add support for MRA (bsc#1111666) - IB/mlx4: Adjust delayed work when a dup is observed (bsc#1111666) - IB/mlx4: Fix leak in id_map_find_del (bsc#1111666) - IB/mlx4: Fix memory leak in add_gid error flow (bsc#1111666) - IB/mlx4: Fix race condition between catas error reset and aliasguid flows (bsc#1111666) - IB/mlx4: Fix starvation in paravirt mux/demux (bsc#1111666) - IB/mlx4: Follow mirror sequence of device add during device removal (bsc#1111666) - IB/mlx4: Remove unneeded NULL check (bsc#1111666) - IB/mlx4: Test return value of calls to ib_get_cached_pkey (bsc#1111666) - IB/mlx5: Add missing XRC options to QP optional params mask (bsc#1111666) - IB/mlx5: Compare only index part of a memory window rkey (bsc#1111666) - IB/mlx5: Do not override existing ip_protocol (bsc#1111666) - IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification (bsc#1111666) - IB/mlx5: Fix clean_mr() to work in the expected order (bsc#1111666) - IB/mlx5: Fix implicit MR release flow (bsc#1111666) - IB/mlx5: Fix outstanding_pi index for GSI qps (bsc#1111666) - IB/mlx5: Fix unreg_umr to ignore the mkey state (bsc#1111666) - IB/mlx5: Improve ODP debugging messages (bsc#1111666) - IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache (bsc#1111666) - IB/mlx5: Prevent concurrent MR updates during invalidation (bsc#1111666) - IB/mlx5: Reset access mask when looping inside page fault handler (bsc#1111666) - IB/mlx5: Set correct write permissions for implicit ODP MR (bsc#1111666) - IB/mlx5: Use direct mkey destroy command upon UMR unreg failure (bsc#1111666) - IB/mlx5: Use fragmented QP's buffer for in-kernel users (bsc#1111666) - IB/mlx5: WQE dump jumps over first 16 bytes (bsc#1111666) - IB/mthca: fix return value of error branch in mthca_init_cq() (bsc#1111666) - IB/qib: Call kobject_put() when kobject_init_and_add() fails (bsc#1111666) - IB/qib: Fix an error code in qib_sdma_verbs_send() (bsc#1111666) - IB/qib: Remove a set-but-not-used variable (bsc#1111666) - IB/rdmavt: Convert timers to use timer_setup() (bsc#1111666) - IB/rdmavt: Fix alloc_qpn() WARN_ON() (bsc#1111666) - IB/rdmavt: Fix sizeof mismatch (bsc#1111666) - IB/rdmavt: Reset all QPs when the device is shut down (bsc#1111666) - IB/rxe: Fix incorrect cache cleanup in error flow (bsc#1111666) - IB/rxe: Make counters thread safe (bsc#1111666) - IB/srpt: Fix memory leak in srpt_add_one (bsc#1111666) - IB/umad: Avoid additional device reference during open()/close() (bsc#1111666) - IB/umad: Avoid destroying device while it is accessed (bsc#1111666) - IB/umad: Do not check status of nonseekable_open() (bsc#1111666) - IB/umad: Fix kernel crash while unloading ib_umad (bsc#1111666) - IB/umad: Refactor code to use cdev_device_add() (bsc#1111666) - IB/umad: Simplify and avoid dynamic allocation of class (bsc#1111666) - IB/usnic: Fix out of bounds index check in query pkey (bsc#1111666) - IB/uverbs: Fix OOPs upon device disassociation (bsc#1111666) - IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM (bsc#1111666) - IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value (bsc#1111666) - KVM host: kabi fixes for psci_version (bsc#1174726). - KVM: arm64: Add missing #include of <linux/string.h> in guest.c (bsc#1174726). - KVM: arm64: Factor out core register ID enumeration (bsc#1174726). - KVM: arm64: Filter out invalid core register IDs in KVM_GET_REG_LIST (bsc#1174726). - KVM: arm64: Refactor kvm_arm_num_regs() for easier maintenance (bsc#1174726). - KVM: arm64: Reject ioctl access to FPSIMD V-regs on SVE vcpus (bsc#1174726). - NFS: mark nfsiod as CPU_INTENSIVE (bsc#1177304). - NFS: only invalidate dentrys that are clearly invalid (bsc#1178669 bsc#1170139). - PCI: pci-hyperv: Fix build errors on non-SYSFS config (git-fixes). - RDMA/bnxt_re: Fix Send Work Entry state check while polling completions (bsc#1111666) - RDMA/bnxt_re: Fix lifetimes in bnxt_re_task (bsc#1111666) - RDMA/bnxt_re: Fix sizeof mismatch for allocation of pbl_tbl. (bsc#1111666) - RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message (bsc#1111666) - RDMA/cm: Add missing locking around id.state in cm_dup_req_handler (bsc#1111666) - RDMA/cm: Fix checking for allowed duplicate listens (bsc#1111666) - RDMA/cm: Remove a race freeing timewait_info (bsc#1111666) - RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow (bsc#1111666) - RDMA/cma: Fix false error message (bsc#1111666) - RDMA/cma: Protect bind_list and listen_list while finding matching cm id (bsc#1111666) - RDMA/cma: add missed unregister_pernet_subsys in init failure (bsc#1111666) - RDMA/cma: fix null-ptr-deref Read in cma_cleanup (bsc#1111666) - RDMA/core: Do not depend device ODP capabilities on kconfig option (bsc#1111666) - RDMA/core: Fix invalid memory access in spec_filter_size (bsc#1111666) - RDMA/core: Fix locking in ib_uverbs_event_read (bsc#1111666) - RDMA/core: Fix protection fault in ib_mr_pool_destroy (bsc#1111666) - RDMA/core: Fix race between destroy and release FD object (bsc#1111666) - RDMA/core: Fix race when resolving IP address (bsc#1111666) - RDMA/core: Prevent mixed use of FDs between shared ufiles (bsc#1111666) - RDMA/cxgb3: Delete and properly mark unimplemented resize CQ function (bsc#1111666) - RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN (bsc#1111666) - RDMA/hns: Correct typo of hns_roce_create_cq() (bsc#1111666) - RDMA/hns: Remove unsupported modify_port callback (bsc#1111666) - RDMA/hns: Set the unsupported wr opcode (bsc#1111666) - RDMA/i40iw: Set queue pair state when being queried (bsc#1111666) - RDMA/i40iw: fix a potential NULL pointer dereference (bsc#1111666) - RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() (bsc#1111666) - RDMA/ipoib: Remove check for ETH_SS_TEST (bsc#1111666) - RDMA/ipoib: Return void from ipoib_ib_dev_stop() (bsc#1111666) - RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces (bsc#1111666) - RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case (bsc#1111666) - RDMA/iw_cxgb4: Fix the unchecked ep dereference (bsc#1111666) - RDMA/iwcm: Fix a lock inversion issue (bsc#1111666) - RDMA/iwcm: Fix iwcm work deallocation (bsc#1111666) - RDMA/iwcm: move iw_rem_ref() calls out of spinlock (bsc#1111666) - RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() (bsc#1111666) - RDMA/mlx4: Initialize ib_spec on the stack (bsc#1111666) - RDMA/mlx4: Read pkey table length instead of hardcoded value (bsc#1111666) - RDMA/mlx5: Clear old rate limit when closing QP (bsc#1111666) - RDMA/mlx5: Delete unreachable handle_atomic code by simplifying SW completion (bsc#1111666) - RDMA/mlx5: Fix a race with mlx5_ib_update_xlt on an implicit MR (bsc#1111666) - RDMA/mlx5: Fix access to wrong pointer while performing flush due to error (bsc#1111666) - RDMA/mlx5: Fix function name typo 'fileds' -> 'fields' (bsc#1111666) - RDMA/mlx5: Return proper error value (bsc#1111666) - RDMA/mlx5: Set GRH fields in query QP on RoCE (bsc#1111666) - RDMA/mlx5: Verify that QP is created with RQ or SQ (bsc#1111666) - RDMA/nes: Remove second wait queue initialization call (bsc#1111666) - RDMA/netlink: Do not always generate an ACK for some netlink operations (bsc#1111666) - RDMA/ocrdma: Fix out of bounds index check in query pkey (bsc#1111666) - RDMA/ocrdma: Remove unsupported modify_port callback (bsc#1111666) - RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe() (bsc#1111666) - RDMA/qedr: Endianness warnings cleanup (bsc#1111666) - RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532 (bsc#1050545). - RDMA/qedr: Fix doorbell setting (bsc#1111666) - RDMA/qedr: Fix memory leak in iWARP CM (bsc#1050545 ). - RDMA/qedr: Fix memory leak in user qp and mr (bsc#1111666) - RDMA/qedr: Fix reported firmware version (bsc#1111666) - RDMA/qedr: Fix use of uninitialized field (bsc#1111666) - RDMA/qedr: Remove unsupported modify_port callback (bsc#1111666) - RDMA/qedr: SRQ's bug fixes (bsc#1111666) - RDMA/qib: Delete extra line (bsc#1111666) - RDMA/qib: Remove all occurrences of BUG_ON() (bsc#1111666) - RDMA/qib: Validate ->show()/store() callbacks before calling them (bsc#1111666) - RDMA/rxe: Drop pointless checks in rxe_init_ports (bsc#1111666) - RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM (bsc#1111666) - RDMA/rxe: Fix configuration of atomic queue pair attributes (bsc#1111666) - RDMA/rxe: Fix memleak in rxe_mem_init_user (bsc#1111666) - RDMA/rxe: Fix slab-out-bounds access which lead to kernel crash later (bsc#1111666) - RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq (bsc#1111666) - RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars (bsc#1111666) - RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue (bsc#1111666) - RDMA/rxe: Remove unused rxe_mem_map_pages (bsc#1111666) - RDMA/rxe: Remove useless rxe_init_device_param assignments (bsc#1111666) - RDMA/rxe: Return void from rxe_init_port_param() (bsc#1111666) - RDMA/rxe: Return void from rxe_mem_init_dma() (bsc#1111666) - RDMA/rxe: Set default vendor ID (bsc#1111666) - RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices (bsc#1111666) - RDMA/rxe: Skip dgid check in loopback mode (bsc#1111666) - RDMA/rxe: Use for_each_sg_page iterator on umem SGL (bsc#1111666) - RDMA/srp: Rework SCSI device reset handling (bsc#1111666) - RDMA/srpt: Fix typo in srpt_unregister_mad_agent docstring (bsc#1111666) - RDMA/srpt: Report the SCSI residual to the initiator (bsc#1111666) - RDMA/ucma: Add missing locking around rdma_leave_multicast() (bsc#1111666) - RDMA/ucma: Put a lock around every call to the rdma_cm layer (bsc#1111666) - RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated (bsc#1111666) - RDMA/vmw_pvrdma: Fix memory leak on pvrdma_pci_remove (bsc#1111666) - RDMA/vmw_pvrdma: Use atomic memory allocation in create AH (bsc#1111666) - RDMA: Directly cast the sockaddr union to sockaddr (bsc#1111666) - RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() (bsc#1111666) - Revert 'kernel/reboot.c: convert simple_strtoul to kstrtoint' (bsc#1179418). - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (bsc#1103992). - Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode (git-fixes). - USB: core: Fix regression in Hercules audio card (git-fixes). - Update references in patches.suse/net-smc-tolerate-future-smcd-versions (bsc#1172542 LTC#186070 git-fixes). - arm/arm64: KVM: Add PSCI version selection API (bsc#1174726). - arm64: KVM: Fix system register enumeration (bsc#1174726). - ath10k: Acquire tx_lock in tx error paths (git-fixes). - batman-adv: set .owner to THIS_MODULE (git-fixes). - bnxt_en: Fix race when modifying pause settings (bsc#1050242 ). - bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242). - btrfs: account ticket size at add/delete time (bsc#1178897). - btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897). - btrfs: check rw_devices, not num_devices for balance (bsc#1178897). - btrfs: do not delete mismatched root refs (bsc#1178962). - btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897). - btrfs: fix force usage in inc_block_group_ro (bsc#1178897). - btrfs: fix invalid removal of root ref (bsc#1178962). - btrfs: fix reclaim counter leak of space_info objects (bsc#1178897). - btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897). - btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897). - btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962). - btrfs: split dev-replace locking helpers for read and write (bsc#1178897). Needed as a prep patch for further improvements around btrfs. - can: gs_usb: fix endianess problem with candleLight firmware (git-fixes). - can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (git-fixes). - ceph: add check_session_state() helper and make it global (bsc#1179259). - ceph: check session state after bumping session->s_seq (bsc#1179259). - ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635). - cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211). - cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426). - cifs: remove bogus debug code (bsc#1179427). - cxgb4: Fix offset when clearing filter byte counters (bsc#1064802 bsc#1066129). - docs: ABI: stable: remove a duplicated documentation (git-fixes). - drm/i915/gvt: Set ENHANCED_FRAME_CAP bit (git-fixes). - drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() (git-fixes). - efi/efivars: Add missing kobject_put() in sysfs entry creation error path (git-fixes). - efi/esrt: Fix reference count leak in esre_create_sysfs_entry (git-fixes). - efi/x86: Do not panic or BUG() on non-critical error conditions (git-fixes). - efi/x86: Free efi_pgd with free_pages() (bsc#1112178). - efi/x86: Ignore the memory attributes table on i386 (git-fixes). - efi/x86: Map the entire EFI vendor string before copying it (git-fixes). - efi: cper: Fix possible out-of-bounds access (git-fixes). - efi: provide empty efi_enter_virtual_mode implementation (git-fixes). - efivarfs: fix memory leak in efivarfs_create() (git-fixes). - efivarfs: revert 'fix memory leak in efivarfs_create()' (git-fixes). - fuse: fix page dereference after free (bsc#1179213). - hv_balloon: disable warning when floor reached (git-fixes). - i40iw: Fix error handling in i40iw_manage_arp_cache() (bsc#1111666) - i40iw: Report correct firmware version (bsc#1111666) - i40iw: fix null pointer dereference on a null wqe pointer (bsc#1111666) - igc: Fix returning wrong statistics (bsc#1118657). - iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (git-fixes). - iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (git-fixes). - iw_cxgb4: fix ECN check on the passive accept (bsc#1111666) - iw_cxgb4: only reconnect with MPAv1 if the peer aborts (bsc#1111666) - kABI workaround for usermodehelper changes (bsc#1179406). - kABI: add back flush_dcache_range (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - libnvdimm/nvdimm/flush: Allow architecture to override the flush barrier (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - mac80211: always wind down STA state (git-fixes). - mac80211: free sta in sta_info_insert_finish() on errors (git-fixes). - mlxsw: core: Fix memory leak on module removal (bsc#1112374). - mm: always have io_remap_pfn_range() set pgprot_decrypted() (bsc#1112178). - net/tls: Fix kmap usage (bsc#1109837). - net/tls: missing received data after fast remote close (bsc#1109837). - net: DCB: Validate DCB_ATTR_DCB_BUFFER argument (bsc#1103990 ). - net: ena: fix packet's addresses for rx_offset feature (bsc#1174852). - net: ena: handle bad request id in ena_netdev (git-fixes). - net: qed: fix 'maybe uninitialized' warning (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692). - net: qed: fix async event callbacks unregistering (bsc#1104393 bsc#1104389). - net: qede: fix PTP initialization on recovery (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692). - net: qede: fix use-after-free on recovery and AER handling (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692). - net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() (bsc#1110096). - net_sched: fix a memory leak in atm_tc_init() (bsc#1056657 bsc#1056653 bsc#1056787). - nfc: s3fwrn5: use signed integer for parsing GPIO numbers (git-fixes). - nfp: use correct define to return NONE fec (bsc#1109837). - pinctrl: amd: fix incorrect way to disable debounce filter (git-fixes). - pinctrl: amd: use higher precision for 512 RtcClk (git-fixes). - pinctrl: aspeed: Fix GPI only function problem (git-fixes). - platform/x86: toshiba_acpi: Fix the wrong variable assignment (git-fixes). - powerpc/32: define helpers to get L1 cache sizes (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/64: flush_inval_dcache_range() becomes flush_dcache_range() (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/64: reuse PPC32 static inline flush_dcache_range() (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/mm: Flush cache on memory hot(un)plug (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Add flush routines using new pmem store and sync instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Add new instructions for persistent storage and sync (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Avoid the barrier in flush routines (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range (jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Initialize pmem device on newer hardware (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Restrict papr_scm to P8 and above (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Update ppc64 to use the new barrier instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc: Chunk calls to flush_dcache_range in arch_*_memory (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964 git-fixes). - powerpc: define helpers to get L1 icache sizes (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - qed: fix error return code in qed_iwarp_ll2_start() (bsc#1050536 bsc#1050545). - qed: suppress 'do not support RoCE & iWARP' flooding on HW init (bsc#1050536 bsc#1050545). - qed: suppress false-positives interrupt error messages on HW init (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692). - reboot: fix overflow parsing reboot cpu number (bsc#1179421). - rxe: correctly calculate iCRC for unaligned payloads (bsc#1111666) - rxe: fix error completion wr_id and qp_num (bsc#1111666) - s390/cio: add cond_resched() in the slow_eval_known_fn() loop (bsc#1177805 LTC#188737). - s390/cpum_cf,perf: change DFLT_CCERROR counter name (bsc#1175916 LTC#187937). - s390/dasd: Fix zero write for FBA devices (bsc#1177808 LTC#188739). - s390: kernel/uv: handle length extension properly (bsc#1178940 LTC#189323). - sched/core: Fix PI boosting between RT and DEADLINE tasks (bsc#1112178). - sched/x86: SaveFLAGS on context switch (bsc#1112178). - scripts/git_sort/git_sort.py: add ceph maintainers git tree - scsi: RDMA/srpt: Fix a credit leak for aborted commands (bsc#1111666) - staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (git-fixes). - svcrdma: Fix page leak in svc_rdma_recv_read_chunk() (bsc#1103992). - svcrdma: fix bounce buffers for unaligned offsets and multiple pages (bsc#1103992). - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control (bsc#1109837). - tracing: Fix out of bounds write in get_trace_buf (bsc#1179403). - tty: serial: imx: keep console clocks always on (git-fixes). - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (git-fixes). - usb: gadget: Fix memleak in gadgetfs_fill_super (git-fixes). - usb: gadget: f_midi: Fix memleak in f_midi_alloc (git-fixes). - usb: host: xhci-mtk: avoid runtime suspend when removing hcd (git-fixes). - usermodehelper: reset umask to default before executing user process (bsc#1179406). - video: hyperv_fb: Fix the cache type when mapping the VRAM (git-fixes). - x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect (git-fixes). - x86/PCI: Fix intel_mid_pci.c build error when ACPI is not enabled (git-fixes). - x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs (git-fixes). - x86/hyperv: Clarify comment on x2apic mode (git-fixes). - x86/hyperv: Make vapic support x2apic mode (git-fixes). - x86/microcode/intel: Check patch signature before saving microcode for early loading (bsc#1112178). - x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (bsc#1112178). - x86/sysfb_efi: Add quirks for some devices with swapped width and height (git-fixes). - xfrm: Fix memleak on xfrm state destroy (bsc#1158775). - xfs: revert 'xfs: fix rmap key and record comparison functions' (git-fixes).

Patchnames: openSUSE-2020-2193

CVE-2018-20669

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 21 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2020-15436

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 21 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-15437

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 21 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-27777

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 21 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-28974

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 21 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-29371

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 21 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2020-4788

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 21 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64	—	Vendor Fix

Threats

Impact moderate

References

81 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://lists.opensuse.org/archives/list/security…	self
https://lists.opensuse.org/archives/list/security…	self
https://bugzilla.suse.com/1050242	self
https://bugzilla.suse.com/1050536	self
https://bugzilla.suse.com/1050545	self
https://bugzilla.suse.com/1056653	self
https://bugzilla.suse.com/1056657	self
https://bugzilla.suse.com/1056787	self
https://bugzilla.suse.com/1064802	self
https://bugzilla.suse.com/1066129	self
https://bugzilla.suse.com/1103990	self
https://bugzilla.suse.com/1103992	self
https://bugzilla.suse.com/1104389	self
https://bugzilla.suse.com/1104393	self
https://bugzilla.suse.com/1109837	self
https://bugzilla.suse.com/1110096	self
https://bugzilla.suse.com/1111666	self
https://bugzilla.suse.com/1112178	self
https://bugzilla.suse.com/1112374	self
https://bugzilla.suse.com/1118657	self
https://bugzilla.suse.com/1122971	self
https://bugzilla.suse.com/1136460	self
https://bugzilla.suse.com/1136461	self
https://bugzilla.suse.com/1158775	self
https://bugzilla.suse.com/1170139	self
https://bugzilla.suse.com/1172542	self
https://bugzilla.suse.com/1174726	self
https://bugzilla.suse.com/1174852	self
https://bugzilla.suse.com/1175916	self
https://bugzilla.suse.com/1176109	self
https://bugzilla.suse.com/1177304	self
https://bugzilla.suse.com/1177666	self
https://bugzilla.suse.com/1177805	self
https://bugzilla.suse.com/1177808	self
https://bugzilla.suse.com/1178589	self
https://bugzilla.suse.com/1178635	self
https://bugzilla.suse.com/1178669	self
https://bugzilla.suse.com/1178897	self
https://bugzilla.suse.com/1178940	self
https://bugzilla.suse.com/1178962	self
https://bugzilla.suse.com/1179107	self
https://bugzilla.suse.com/1179140	self
https://bugzilla.suse.com/1179141	self
https://bugzilla.suse.com/1179211	self
https://bugzilla.suse.com/1179213	self
https://bugzilla.suse.com/1179259	self
https://bugzilla.suse.com/1179403	self
https://bugzilla.suse.com/1179406	self
https://bugzilla.suse.com/1179418	self
https://bugzilla.suse.com/1179421	self
https://bugzilla.suse.com/1179424	self
https://bugzilla.suse.com/1179426	self
https://bugzilla.suse.com/1179427	self
https://bugzilla.suse.com/1179429	self
https://www.suse.com/security/cve/CVE-2018-20669/	self
https://www.suse.com/security/cve/CVE-2020-15436/	self
https://www.suse.com/security/cve/CVE-2020-15437/	self
https://www.suse.com/security/cve/CVE-2020-27777/	self
https://www.suse.com/security/cve/CVE-2020-28974/	self
https://www.suse.com/security/cve/CVE-2020-29371/	self
https://www.suse.com/security/cve/CVE-2020-4788/	self
https://www.suse.com/security/cve/CVE-2018-20669	external
https://bugzilla.suse.com/1122971	external
https://www.suse.com/security/cve/CVE-2020-15436	external
https://bugzilla.suse.com/1179141	external
https://www.suse.com/security/cve/CVE-2020-15437	external
https://bugzilla.suse.com/1179140	external
https://www.suse.com/security/cve/CVE-2020-27777	external
https://bugzilla.suse.com/1179107	external
https://bugzilla.suse.com/1179419	external
https://bugzilla.suse.com/1200343	external
https://bugzilla.suse.com/1220060	external
https://www.suse.com/security/cve/CVE-2020-28974	external
https://bugzilla.suse.com/1178589	external
https://www.suse.com/security/cve/CVE-2020-29371	external
https://bugzilla.suse.com/1179429	external
https://www.suse.com/security/cve/CVE-2020-4788	external
https://bugzilla.suse.com/1177666	external
https://bugzilla.suse.com/1181158	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\n\nThe openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c where uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd (bnc#1179429).\n- CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c allowed local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field (bnc#1179141).\n- CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#1177666).\n- CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c, where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).\n- CVE-2020-15437: The Linux kernel was vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allowed local users to cause a denial of service by using the p-\u003eserial_in pointer which uninitialized (bnc#1179140).\n- CVE-2020-27777: Restrict RTAS requests from userspace  (CVE-2020-27777 bsc#1179107).\n- CVE-2020-28974: A slab-out-of-bounds read in fbcon could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height (bnc#1178589).\n\nThe following non-security bugs were fixed:\n\n- ACPI: GED: fix -Wformat (git-fixes).\n- ALSA: ctl: fix error path at adding user-defined element set (git-fixes).\n- ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).\n- ALSA: mixart: Fix mutex deadlock (git-fixes).\n- ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).\n- Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).\n- Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).\n- Convert trailing spaces and periods in path components (bsc#1179424).\n- Drivers: hv: vmbus: Remove the unused \u0027tsc_page\u0027 from struct hv_context (git-fixes).\n- IB/cma: Fix ports memory leak in cma_configfs (bsc#1111666)\n- IB/core: Set qp-\u003ereal_qp before it may be accessed (bsc#1111666)\n- IB/hfi1, qib: Ensure RCU is locked when accessing list (bsc#1111666)\n- IB/hfi1: Add RcvShortLengthErrCnt to hfi1stats (bsc#1111666)\n- IB/hfi1: Add missing INVALIDATE opcodes for trace (bsc#1111666)\n- IB/hfi1: Add software counter for ctxt0 seq drop (bsc#1111666)\n- IB/hfi1: Avoid hardlockup with flushlist_lock (bsc#1111666)\n- IB/hfi1: Call kobject_put() when kobject_init_and_add() fails (bsc#1111666)\n- IB/hfi1: Check for error on call to alloc_rsm_map_table (bsc#1111666)\n- IB/hfi1: Close PSM sdma_progress sleep window (bsc#1111666)\n- IB/hfi1: Define variables as unsigned long to fix KASAN warning (bsc#1111666)\n- IB/hfi1: Ensure full Gen3 speed in a Gen4 system (bsc#1111666)\n- IB/hfi1: Fix Spectre v1 vulnerability (bsc#1111666)\n- IB/hfi1: Fix memory leaks in sysfs registration and unregistration (bsc#1111666)\n- IB/hfi1: Handle port down properly in pio (bsc#1111666)\n- IB/hfi1: Handle wakeup of orphaned QPs for pio (bsc#1111666)\n- IB/hfi1: Insure freeze_work work_struct is canceled on shutdown (bsc#1111666)\n- IB/hfi1: Remove unused define (bsc#1111666)\n- IB/hfi1: Silence txreq allocation warnings (bsc#1111666)\n- IB/hfi1: Validate page aligned for a given virtual address (bsc#1111666)\n- IB/hfi1: Wakeup QPs orphaned on wait list after flush (bsc#1111666)\n- IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode (bsc#1111666)\n- IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start (bsc#1111666)\n- IB/ipoib: drop useless LIST_HEAD (bsc#1111666)\n- IB/iser: Fix dma_nents type definition (bsc#1111666)\n- IB/iser: Pass the correct number of entries for dma mapped SGL (bsc#1111666)\n- IB/mad: Fix use-after-free in ib mad completion handling (bsc#1111666)\n- IB/mlx4: Add and improve logging (bsc#1111666)\n- IB/mlx4: Add support for MRA (bsc#1111666)\n- IB/mlx4: Adjust delayed work when a dup is observed (bsc#1111666)\n- IB/mlx4: Fix leak in id_map_find_del (bsc#1111666)\n- IB/mlx4: Fix memory leak in add_gid error flow (bsc#1111666)\n- IB/mlx4: Fix race condition between catas error reset and aliasguid flows (bsc#1111666)\n- IB/mlx4: Fix starvation in paravirt mux/demux (bsc#1111666)\n- IB/mlx4: Follow mirror sequence of device add during device removal (bsc#1111666)\n- IB/mlx4: Remove unneeded NULL check (bsc#1111666)\n- IB/mlx4: Test return value of calls to ib_get_cached_pkey (bsc#1111666)\n- IB/mlx5: Add missing XRC options to QP optional params mask (bsc#1111666)\n- IB/mlx5: Compare only index part of a memory window rkey (bsc#1111666)\n- IB/mlx5: Do not override existing ip_protocol (bsc#1111666)\n- IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification (bsc#1111666)\n- IB/mlx5: Fix clean_mr() to work in the expected order (bsc#1111666)\n- IB/mlx5: Fix implicit MR release flow (bsc#1111666)\n- IB/mlx5: Fix outstanding_pi index for GSI qps (bsc#1111666)\n- IB/mlx5: Fix unreg_umr to ignore the mkey state (bsc#1111666)\n- IB/mlx5: Improve ODP debugging messages (bsc#1111666)\n- IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache (bsc#1111666)\n- IB/mlx5: Prevent concurrent MR updates during invalidation (bsc#1111666)\n- IB/mlx5: Reset access mask when looping inside page fault handler (bsc#1111666)\n- IB/mlx5: Set correct write permissions for implicit ODP MR (bsc#1111666)\n- IB/mlx5: Use direct mkey destroy command upon UMR unreg failure (bsc#1111666)\n- IB/mlx5: Use fragmented QP\u0027s buffer for in-kernel users (bsc#1111666)\n- IB/mlx5: WQE dump jumps over first 16 bytes (bsc#1111666)\n- IB/mthca: fix return value of error branch in mthca_init_cq() (bsc#1111666)\n- IB/qib: Call kobject_put() when kobject_init_and_add() fails (bsc#1111666)\n- IB/qib: Fix an error code in qib_sdma_verbs_send() (bsc#1111666)\n- IB/qib: Remove a set-but-not-used variable (bsc#1111666)\n- IB/rdmavt: Convert timers to use timer_setup() (bsc#1111666)\n- IB/rdmavt: Fix alloc_qpn() WARN_ON() (bsc#1111666)\n- IB/rdmavt: Fix sizeof mismatch (bsc#1111666)\n- IB/rdmavt: Reset all QPs when the device is shut down (bsc#1111666)\n- IB/rxe: Fix incorrect cache cleanup in error flow (bsc#1111666)\n- IB/rxe: Make counters thread safe (bsc#1111666)\n- IB/srpt: Fix memory leak in srpt_add_one (bsc#1111666)\n- IB/umad: Avoid additional device reference during open()/close() (bsc#1111666)\n- IB/umad: Avoid destroying device while it is accessed (bsc#1111666)\n- IB/umad: Do not check status of nonseekable_open() (bsc#1111666)\n- IB/umad: Fix kernel crash while unloading ib_umad (bsc#1111666)\n- IB/umad: Refactor code to use cdev_device_add() (bsc#1111666)\n- IB/umad: Simplify and avoid dynamic allocation of class (bsc#1111666)\n- IB/usnic: Fix out of bounds index check in query pkey (bsc#1111666)\n- IB/uverbs: Fix OOPs upon device disassociation (bsc#1111666)\n- IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM (bsc#1111666)\n- IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value (bsc#1111666)\n- KVM host: kabi fixes for psci_version (bsc#1174726).\n- KVM: arm64: Add missing #include of \u0026lt;linux/string.h\u003e in guest.c (bsc#1174726).\n- KVM: arm64: Factor out core register ID enumeration (bsc#1174726).\n- KVM: arm64: Filter out invalid core register IDs in KVM_GET_REG_LIST (bsc#1174726).\n- KVM: arm64: Refactor kvm_arm_num_regs() for easier maintenance (bsc#1174726).\n- KVM: arm64: Reject ioctl access to FPSIMD V-regs on SVE vcpus (bsc#1174726).\n- NFS: mark nfsiod as CPU_INTENSIVE (bsc#1177304).\n- NFS: only invalidate dentrys that are clearly invalid (bsc#1178669 bsc#1170139).\n- PCI: pci-hyperv: Fix build errors on non-SYSFS config (git-fixes).\n- RDMA/bnxt_re: Fix Send Work Entry state check while polling completions (bsc#1111666)\n- RDMA/bnxt_re: Fix lifetimes in bnxt_re_task (bsc#1111666)\n- RDMA/bnxt_re: Fix sizeof mismatch for allocation of pbl_tbl. (bsc#1111666)\n- RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message (bsc#1111666)\n- RDMA/cm: Add missing locking around id.state in cm_dup_req_handler (bsc#1111666)\n- RDMA/cm: Fix checking for allowed duplicate listens (bsc#1111666)\n- RDMA/cm: Remove a race freeing timewait_info (bsc#1111666)\n- RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow (bsc#1111666)\n- RDMA/cma: Fix false error message (bsc#1111666)\n- RDMA/cma: Protect bind_list and listen_list while finding matching cm id (bsc#1111666)\n- RDMA/cma: add missed unregister_pernet_subsys in init failure (bsc#1111666)\n- RDMA/cma: fix null-ptr-deref Read in cma_cleanup (bsc#1111666)\n- RDMA/core: Do not depend device ODP capabilities on kconfig option (bsc#1111666)\n- RDMA/core: Fix invalid memory access in spec_filter_size (bsc#1111666)\n- RDMA/core: Fix locking in ib_uverbs_event_read (bsc#1111666)\n- RDMA/core: Fix protection fault in ib_mr_pool_destroy (bsc#1111666)\n- RDMA/core: Fix race between destroy and release FD object (bsc#1111666)\n- RDMA/core: Fix race when resolving IP address (bsc#1111666)\n- RDMA/core: Prevent mixed use of FDs between shared ufiles (bsc#1111666)\n- RDMA/cxgb3: Delete and properly mark unimplemented resize CQ function (bsc#1111666)\n- RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN (bsc#1111666)\n- RDMA/hns: Correct typo of hns_roce_create_cq() (bsc#1111666)\n- RDMA/hns: Remove unsupported modify_port callback (bsc#1111666)\n- RDMA/hns: Set the unsupported wr opcode (bsc#1111666)\n- RDMA/i40iw: Set queue pair state when being queried (bsc#1111666)\n- RDMA/i40iw: fix a potential NULL pointer dereference (bsc#1111666)\n- RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() (bsc#1111666)\n- RDMA/ipoib: Remove check for ETH_SS_TEST (bsc#1111666)\n- RDMA/ipoib: Return void from ipoib_ib_dev_stop() (bsc#1111666)\n- RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces (bsc#1111666)\n- RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case (bsc#1111666)\n- RDMA/iw_cxgb4: Fix the unchecked ep dereference (bsc#1111666)\n- RDMA/iwcm: Fix a lock inversion issue (bsc#1111666)\n- RDMA/iwcm: Fix iwcm work deallocation (bsc#1111666)\n- RDMA/iwcm: move iw_rem_ref() calls out of spinlock (bsc#1111666)\n- RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() (bsc#1111666)\n- RDMA/mlx4: Initialize ib_spec on the stack (bsc#1111666)\n- RDMA/mlx4: Read pkey table length instead of hardcoded value (bsc#1111666)\n- RDMA/mlx5: Clear old rate limit when closing QP (bsc#1111666)\n- RDMA/mlx5: Delete unreachable handle_atomic code by simplifying SW completion (bsc#1111666)\n- RDMA/mlx5: Fix a race with mlx5_ib_update_xlt on an implicit MR (bsc#1111666)\n- RDMA/mlx5: Fix access to wrong pointer while performing flush due to error (bsc#1111666)\n- RDMA/mlx5: Fix function name typo \u0027fileds\u0027 -\u003e \u0027fields\u0027 (bsc#1111666)\n- RDMA/mlx5: Return proper error value (bsc#1111666)\n- RDMA/mlx5: Set GRH fields in query QP on RoCE (bsc#1111666)\n- RDMA/mlx5: Verify that QP is created with RQ or SQ (bsc#1111666)\n- RDMA/nes: Remove second wait queue initialization call (bsc#1111666)\n- RDMA/netlink: Do not always generate an ACK for some netlink operations (bsc#1111666)\n- RDMA/ocrdma: Fix out of bounds index check in query pkey (bsc#1111666)\n- RDMA/ocrdma: Remove unsupported modify_port callback (bsc#1111666)\n- RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe() (bsc#1111666)\n- RDMA/qedr: Endianness warnings cleanup (bsc#1111666)\n- RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532 (bsc#1050545).\n- RDMA/qedr: Fix doorbell setting (bsc#1111666)\n- RDMA/qedr: Fix memory leak in iWARP CM (bsc#1050545 ).\n- RDMA/qedr: Fix memory leak in user qp and mr (bsc#1111666)\n- RDMA/qedr: Fix reported firmware version (bsc#1111666)\n- RDMA/qedr: Fix use of uninitialized field (bsc#1111666)\n- RDMA/qedr: Remove unsupported modify_port callback (bsc#1111666)\n- RDMA/qedr: SRQ\u0027s bug fixes (bsc#1111666)\n- RDMA/qib: Delete extra line (bsc#1111666)\n- RDMA/qib: Remove all occurrences of BUG_ON() (bsc#1111666)\n- RDMA/qib: Validate -\u003eshow()/store() callbacks before calling them (bsc#1111666)\n- RDMA/rxe: Drop pointless checks in rxe_init_ports (bsc#1111666)\n- RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM (bsc#1111666)\n- RDMA/rxe: Fix configuration of atomic queue pair attributes (bsc#1111666)\n- RDMA/rxe: Fix memleak in rxe_mem_init_user (bsc#1111666)\n- RDMA/rxe: Fix slab-out-bounds access which lead to kernel crash later (bsc#1111666)\n- RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq (bsc#1111666)\n- RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars (bsc#1111666)\n- RDMA/rxe: Prevent access to wr-\u003enext ptr afrer wr is posted to send queue (bsc#1111666)\n- RDMA/rxe: Remove unused rxe_mem_map_pages (bsc#1111666)\n- RDMA/rxe: Remove useless rxe_init_device_param assignments (bsc#1111666)\n- RDMA/rxe: Return void from rxe_init_port_param() (bsc#1111666)\n- RDMA/rxe: Return void from rxe_mem_init_dma() (bsc#1111666)\n- RDMA/rxe: Set default vendor ID (bsc#1111666)\n- RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices (bsc#1111666)\n- RDMA/rxe: Skip dgid check in loopback mode (bsc#1111666)\n- RDMA/rxe: Use for_each_sg_page iterator on umem SGL (bsc#1111666)\n- RDMA/srp: Rework SCSI device reset handling (bsc#1111666)\n- RDMA/srpt: Fix typo in srpt_unregister_mad_agent docstring (bsc#1111666)\n- RDMA/srpt: Report the SCSI residual to the initiator (bsc#1111666)\n- RDMA/ucma: Add missing locking around rdma_leave_multicast() (bsc#1111666)\n- RDMA/ucma: Put a lock around every call to the rdma_cm layer (bsc#1111666)\n- RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated (bsc#1111666)\n- RDMA/vmw_pvrdma: Fix memory leak on pvrdma_pci_remove (bsc#1111666)\n- RDMA/vmw_pvrdma: Use atomic memory allocation in create AH (bsc#1111666)\n- RDMA: Directly cast the sockaddr union to sockaddr (bsc#1111666)\n- RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() (bsc#1111666)\n- Revert \u0027kernel/reboot.c: convert simple_strtoul to kstrtoint\u0027 (bsc#1179418).\n- SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (bsc#1103992).\n- Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode (git-fixes).\n- USB: core: Fix regression in Hercules audio card (git-fixes).\n- Update references in patches.suse/net-smc-tolerate-future-smcd-versions (bsc#1172542 LTC#186070 git-fixes).\n- arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).\n- arm64: KVM: Fix system register enumeration (bsc#1174726).\n- ath10k: Acquire tx_lock in tx error paths (git-fixes).\n- batman-adv: set .owner to THIS_MODULE (git-fixes).\n- bnxt_en: Fix race when modifying pause settings (bsc#1050242 ).\n- bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242).\n- btrfs: account ticket size at add/delete time (bsc#1178897).\n- btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).\n- btrfs: check rw_devices, not num_devices for balance (bsc#1178897).\n- btrfs: do not delete mismatched root refs (bsc#1178962).\n- btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).\n- btrfs: fix force usage in inc_block_group_ro (bsc#1178897).\n- btrfs: fix invalid removal of root ref (bsc#1178962).\n- btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).\n- btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).\n- btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).\n- btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).\n- btrfs: split dev-replace locking helpers for read and write (bsc#1178897). Needed as a prep patch for further improvements around btrfs.\n- can: gs_usb: fix endianess problem with candleLight firmware (git-fixes).\n- can: m_can: fix nominal bitiming tseg2 min for version \u003e= 3.1 (git-fixes).\n- ceph: add check_session_state() helper and make it global (bsc#1179259).\n- ceph: check session state after bumping session-\u003es_seq (bsc#1179259).\n- ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635).\n- cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211).\n- cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426).\n- cifs: remove bogus debug code (bsc#1179427).\n- cxgb4: Fix offset when clearing filter byte counters (bsc#1064802 bsc#1066129).\n- docs: ABI: stable: remove a duplicated documentation (git-fixes).\n- drm/i915/gvt: Set ENHANCED_FRAME_CAP bit (git-fixes).\n- drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() (git-fixes).\n- efi/efivars: Add missing kobject_put() in sysfs entry creation error path (git-fixes).\n- efi/esrt: Fix reference count leak in esre_create_sysfs_entry (git-fixes).\n- efi/x86: Do not panic or BUG() on non-critical error conditions (git-fixes).\n- efi/x86: Free efi_pgd with free_pages() (bsc#1112178).\n- efi/x86: Ignore the memory attributes table on i386 (git-fixes).\n- efi/x86: Map the entire EFI vendor string before copying it (git-fixes).\n- efi: cper: Fix possible out-of-bounds access (git-fixes).\n- efi: provide empty efi_enter_virtual_mode implementation (git-fixes).\n- efivarfs: fix memory leak in efivarfs_create() (git-fixes).\n- efivarfs: revert \u0027fix memory leak in efivarfs_create()\u0027 (git-fixes).\n- fuse: fix page dereference after free (bsc#1179213).\n- hv_balloon: disable warning when floor reached (git-fixes).\n- i40iw: Fix error handling in i40iw_manage_arp_cache() (bsc#1111666)\n- i40iw: Report correct firmware version (bsc#1111666)\n- i40iw: fix null pointer dereference on a null wqe pointer (bsc#1111666)\n- igc: Fix returning wrong statistics (bsc#1118657).\n- iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (git-fixes).\n- iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (git-fixes).\n- iw_cxgb4: fix ECN check on the passive accept (bsc#1111666)\n- iw_cxgb4: only reconnect with MPAv1 if the peer aborts (bsc#1111666)\n- kABI workaround for usermodehelper changes (bsc#1179406).\n- kABI: add back flush_dcache_range (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- libnvdimm/nvdimm/flush: Allow architecture to override the flush barrier (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- mac80211: always wind down STA state (git-fixes).\n- mac80211: free sta in sta_info_insert_finish() on errors (git-fixes).\n- mlxsw: core: Fix memory leak on module removal (bsc#1112374).\n- mm: always have io_remap_pfn_range() set pgprot_decrypted() (bsc#1112178).\n- net/tls: Fix kmap usage (bsc#1109837).\n- net/tls: missing received data after fast remote close (bsc#1109837).\n- net: DCB: Validate DCB_ATTR_DCB_BUFFER argument (bsc#1103990 ).\n- net: ena: fix packet\u0027s addresses for rx_offset feature (bsc#1174852).\n- net: ena: handle bad request id in ena_netdev (git-fixes).\n- net: qed: fix \u0027maybe uninitialized\u0027 warning (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692).\n- net: qed: fix async event callbacks unregistering (bsc#1104393 bsc#1104389).\n- net: qede: fix PTP initialization on recovery (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692).\n- net: qede: fix use-after-free on recovery and AER handling (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692).\n- net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() (bsc#1110096).\n- net_sched: fix a memory leak in atm_tc_init() (bsc#1056657 bsc#1056653 bsc#1056787).\n- nfc: s3fwrn5: use signed integer for parsing GPIO numbers (git-fixes).\n- nfp: use correct define to return NONE fec (bsc#1109837).\n- pinctrl: amd: fix incorrect way to disable debounce filter (git-fixes).\n- pinctrl: amd: use higher precision for 512 RtcClk (git-fixes).\n- pinctrl: aspeed: Fix GPI only function problem (git-fixes).\n- platform/x86: toshiba_acpi: Fix the wrong variable assignment (git-fixes).\n- powerpc/32: define helpers to get L1 cache sizes (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/64: flush_inval_dcache_range() becomes flush_dcache_range() (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/64: reuse PPC32 static inline flush_dcache_range() (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/mm: Flush cache on memory hot(un)plug (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Add flush routines using new pmem store and sync instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Add new instructions for persistent storage and sync (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Avoid the barrier in flush routines (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range (jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Initialize pmem device on newer hardware (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Restrict papr_scm to P8 and above (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Update ppc64 to use the new barrier instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc: Chunk calls to flush_dcache_range in arch_*_memory (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964 git-fixes).\n- powerpc: define helpers to get L1 icache sizes (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- qed: fix error return code in qed_iwarp_ll2_start() (bsc#1050536 bsc#1050545).\n- qed: suppress \u0027do not support RoCE \u0026 iWARP\u0027 flooding on HW init (bsc#1050536 bsc#1050545).\n- qed: suppress false-positives interrupt error messages on HW init (bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692).\n- reboot: fix overflow parsing reboot cpu number (bsc#1179421).\n- rxe: correctly calculate iCRC for unaligned payloads (bsc#1111666)\n- rxe: fix error completion wr_id and qp_num (bsc#1111666)\n- s390/cio: add cond_resched() in the slow_eval_known_fn() loop (bsc#1177805 LTC#188737).\n- s390/cpum_cf,perf: change DFLT_CCERROR counter name (bsc#1175916 LTC#187937).\n- s390/dasd: Fix zero write for FBA devices (bsc#1177808 LTC#188739).\n- s390: kernel/uv: handle length extension properly (bsc#1178940 LTC#189323).\n- sched/core: Fix PI boosting between RT and DEADLINE tasks (bsc#1112178).\n- sched/x86: SaveFLAGS on context switch (bsc#1112178).\n- scripts/git_sort/git_sort.py: add ceph maintainers git tree\n- scsi: RDMA/srpt: Fix a credit leak for aborted commands (bsc#1111666)\n- staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (git-fixes).\n- svcrdma: Fix page leak in svc_rdma_recv_read_chunk() (bsc#1103992).\n- svcrdma: fix bounce buffers for unaligned offsets and multiple pages (bsc#1103992).\n- tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control (bsc#1109837).\n- tracing: Fix out of bounds write in get_trace_buf (bsc#1179403).\n- tty: serial: imx: keep console clocks always on (git-fixes).\n- usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (git-fixes).\n- usb: gadget: Fix memleak in gadgetfs_fill_super (git-fixes).\n- usb: gadget: f_midi: Fix memleak in f_midi_alloc (git-fixes).\n- usb: host: xhci-mtk: avoid runtime suspend when removing hcd (git-fixes).\n- usermodehelper: reset umask to default before executing user process (bsc#1179406).\n- video: hyperv_fb: Fix the cache type when mapping the VRAM (git-fixes).\n- x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect (git-fixes).\n- x86/PCI: Fix intel_mid_pci.c build error when ACPI is not enabled (git-fixes).\n- x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs (git-fixes).\n- x86/hyperv: Clarify comment on x2apic mode (git-fixes).\n- x86/hyperv: Make vapic support x2apic mode (git-fixes).\n- x86/microcode/intel: Check patch signature before saving microcode for early loading (bsc#1112178).\n- x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (bsc#1112178).\n- x86/sysfb_efi: Add quirks for some devices with swapped width and height (git-fixes).\n- xfrm: Fix memleak on xfrm state destroy (bsc#1158775).\n- xfs: revert \u0027xfs: fix rmap key and record comparison functions\u0027 (git-fixes).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-2193",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_2193-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:2193-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4YRSQJNKLIOJJTD3P2UKMHRFMCIG3JDN/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:2193-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4YRSQJNKLIOJJTD3P2UKMHRFMCIG3JDN/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1050242",
        "url": "https://bugzilla.suse.com/1050242"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1050536",
        "url": "https://bugzilla.suse.com/1050536"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1050545",
        "url": "https://bugzilla.suse.com/1050545"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1056653",
        "url": "https://bugzilla.suse.com/1056653"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1056657",
        "url": "https://bugzilla.suse.com/1056657"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1056787",
        "url": "https://bugzilla.suse.com/1056787"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1064802",
        "url": "https://bugzilla.suse.com/1064802"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1066129",
        "url": "https://bugzilla.suse.com/1066129"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1103990",
        "url": "https://bugzilla.suse.com/1103990"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1103992",
        "url": "https://bugzilla.suse.com/1103992"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1104389",
        "url": "https://bugzilla.suse.com/1104389"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1104393",
        "url": "https://bugzilla.suse.com/1104393"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1109837",
        "url": "https://bugzilla.suse.com/1109837"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1110096",
        "url": "https://bugzilla.suse.com/1110096"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1111666",
        "url": "https://bugzilla.suse.com/1111666"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1112178",
        "url": "https://bugzilla.suse.com/1112178"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1112374",
        "url": "https://bugzilla.suse.com/1112374"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1118657",
        "url": "https://bugzilla.suse.com/1118657"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1122971",
        "url": "https://bugzilla.suse.com/1122971"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1136460",
        "url": "https://bugzilla.suse.com/1136460"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1136461",
        "url": "https://bugzilla.suse.com/1136461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1158775",
        "url": "https://bugzilla.suse.com/1158775"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1170139",
        "url": "https://bugzilla.suse.com/1170139"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172542",
        "url": "https://bugzilla.suse.com/1172542"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1174726",
        "url": "https://bugzilla.suse.com/1174726"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1174852",
        "url": "https://bugzilla.suse.com/1174852"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1175916",
        "url": "https://bugzilla.suse.com/1175916"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176109",
        "url": "https://bugzilla.suse.com/1176109"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177304",
        "url": "https://bugzilla.suse.com/1177304"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177666",
        "url": "https://bugzilla.suse.com/1177666"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177805",
        "url": "https://bugzilla.suse.com/1177805"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177808",
        "url": "https://bugzilla.suse.com/1177808"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178589",
        "url": "https://bugzilla.suse.com/1178589"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178635",
        "url": "https://bugzilla.suse.com/1178635"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178669",
        "url": "https://bugzilla.suse.com/1178669"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178897",
        "url": "https://bugzilla.suse.com/1178897"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178940",
        "url": "https://bugzilla.suse.com/1178940"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178962",
        "url": "https://bugzilla.suse.com/1178962"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179107",
        "url": "https://bugzilla.suse.com/1179107"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179140",
        "url": "https://bugzilla.suse.com/1179140"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179141",
        "url": "https://bugzilla.suse.com/1179141"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179211",
        "url": "https://bugzilla.suse.com/1179211"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179213",
        "url": "https://bugzilla.suse.com/1179213"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179259",
        "url": "https://bugzilla.suse.com/1179259"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179403",
        "url": "https://bugzilla.suse.com/1179403"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179406",
        "url": "https://bugzilla.suse.com/1179406"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179418",
        "url": "https://bugzilla.suse.com/1179418"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179421",
        "url": "https://bugzilla.suse.com/1179421"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179424",
        "url": "https://bugzilla.suse.com/1179424"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179426",
        "url": "https://bugzilla.suse.com/1179426"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179427",
        "url": "https://bugzilla.suse.com/1179427"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179429",
        "url": "https://bugzilla.suse.com/1179429"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20669 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20669/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15436 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15436/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15437 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15437/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27777 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27777/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28974 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28974/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-29371 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-29371/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-4788 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-4788/"
      }
    ],
    "title": "Security update for the Linux Kernel",
    "tracking": {
      "current_release_date": "2020-12-07T11:06:42Z",
      "generator": {
        "date": "2020-12-07T11:06:42Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:2193-1",
      "initial_release_date": "2020-12-07T11:06:42Z",
      "revision_history": [
        {
          "date": "2020-12-07T11:06:42Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-4.12.14-lp151.28.87.1.noarch",
                "product": {
                  "name": "kernel-devel-4.12.14-lp151.28.87.1.noarch",
                  "product_id": "kernel-devel-4.12.14-lp151.28.87.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-docs-4.12.14-lp151.28.87.1.noarch",
                "product": {
                  "name": "kernel-docs-4.12.14-lp151.28.87.1.noarch",
                  "product_id": "kernel-docs-4.12.14-lp151.28.87.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
                "product": {
                  "name": "kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
                  "product_id": "kernel-docs-html-4.12.14-lp151.28.87.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-macros-4.12.14-lp151.28.87.1.noarch",
                "product": {
                  "name": "kernel-macros-4.12.14-lp151.28.87.1.noarch",
                  "product_id": "kernel-macros-4.12.14-lp151.28.87.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-4.12.14-lp151.28.87.1.noarch",
                "product": {
                  "name": "kernel-source-4.12.14-lp151.28.87.1.noarch",
                  "product_id": "kernel-source-4.12.14-lp151.28.87.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
                "product": {
                  "name": "kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
                  "product_id": "kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-debug-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-debug-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-debug-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-debug-base-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-default-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-default-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-default-base-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-default-devel-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-obs-build-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-syms-4.12.14-lp151.28.87.1.x86_64",
                "product": {
                  "name": "kernel-syms-4.12.14-lp151.28.87.1.x86_64",
                  "product_id": "kernel-syms-4.12.14-lp151.28.87.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-vanilla-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64",
                "product": {
                  "name": "kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64",
                  "product_id": "kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-debug-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-base-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-default-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-base-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-devel-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-4.12.14-lp151.28.87.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch"
        },
        "product_reference": "kernel-devel-4.12.14-lp151.28.87.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-docs-4.12.14-lp151.28.87.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch"
        },
        "product_reference": "kernel-docs-4.12.14-lp151.28.87.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-docs-html-4.12.14-lp151.28.87.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch"
        },
        "product_reference": "kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-macros-4.12.14-lp151.28.87.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch"
        },
        "product_reference": "kernel-macros-4.12.14-lp151.28.87.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-obs-build-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-4.12.14-lp151.28.87.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch"
        },
        "product_reference": "kernel-source-4.12.14-lp151.28.87.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch"
        },
        "product_reference": "kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-syms-4.12.14-lp151.28.87.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64"
        },
        "product_reference": "kernel-syms-4.12.14-lp151.28.87.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-vanilla-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        },
        "product_reference": "kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-20669",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20669"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20669",
          "url": "https://www.suse.com/security/cve/CVE-2018-20669"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1122971 for CVE-2018-20669",
          "url": "https://bugzilla.suse.com/1122971"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-07T11:06:42Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-20669"
    },
    {
      "cve": "CVE-2020-15436",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15436"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15436",
          "url": "https://www.suse.com/security/cve/CVE-2020-15436"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179141 for CVE-2020-15436",
          "url": "https://bugzilla.suse.com/1179141"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-07T11:06:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15436"
    },
    {
      "cve": "CVE-2020-15437",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15437"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p-\u003eserial_in pointer which uninitialized.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15437",
          "url": "https://www.suse.com/security/cve/CVE-2020-15437"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179140 for CVE-2020-15437",
          "url": "https://bugzilla.suse.com/1179140"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-07T11:06:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15437"
    },
    {
      "cve": "CVE-2020-27777",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27777"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27777",
          "url": "https://www.suse.com/security/cve/CVE-2020-27777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179107 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1179107"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179419 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1179419"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200343 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1200343"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1220060 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1220060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-07T11:06:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27777"
    },
    {
      "cve": "CVE-2020-28974",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28974"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28974",
          "url": "https://www.suse.com/security/cve/CVE-2020-28974"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178589 for CVE-2020-28974",
          "url": "https://bugzilla.suse.com/1178589"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-07T11:06:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-28974"
    },
    {
      "cve": "CVE-2020-29371",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-29371"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-29371",
          "url": "https://www.suse.com/security/cve/CVE-2020-29371"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179429 for CVE-2020-29371",
          "url": "https://bugzilla.suse.com/1179429"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-07T11:06:42Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-29371"
    },
    {
      "cve": "CVE-2020-4788",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-4788"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
          "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
          "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-4788",
          "url": "https://www.suse.com/security/cve/CVE-2020-4788"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177666 for CVE-2020-4788",
          "url": "https://bugzilla.suse.com/1177666"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181158 for CVE-2020-4788",
          "url": "https://bugzilla.suse.com/1181158"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:kernel-debug-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-debug-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-default-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-devel-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-docs-html-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-kvmsmall-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-kvmsmall-devel-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-macros-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-obs-build-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-obs-qa-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-source-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-source-vanilla-4.12.14-lp151.28.87.1.noarch",
            "openSUSE Leap 15.1:kernel-syms-4.12.14-lp151.28.87.1.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-base-4.12.14-lp151.28.87.2.x86_64",
            "openSUSE Leap 15.1:kernel-vanilla-devel-4.12.14-lp151.28.87.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-07T11:06:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-4788"
    }
  ]
}

OPENSUSE-SU-2020:2260-1

Vulnerability from csaf_opensuse - Published: 2020-12-15 09:29 - Updated: 2020-12-15 09:29

Summary

Security update for the Linux Kernel

Severity

Important

Notes

Title of the patch: Security update for the Linux Kernel

Description of the patch: The SUSE Linux Enterprise 15 SP2 kernel was updated to 3.12.31 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141). - CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140). - CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123). - CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182). - CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393). - CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107) - CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886). - CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589). - CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429). - CVE-2020-25705: Fixed an issue which could have allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization (bsc#1175721). - CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740). - CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666). - CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 1179432). The following non-security bugs were fixed: - 9P: Cast to loff_t before multiplying (git-fixes). - ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes). - ACPICA: Add NHLT table signature (bsc#1176200). - ACPI: dock: fix enum-conversion warning (git-fixes). - ACPI / extlog: Check for RDMSR failure (git-fixes). - ACPI: GED: fix -Wformat (git-fixes). - ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes). - ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes). - Add bug reference to two hv_netvsc patches (bsc#1178853). - ALSA: ctl: fix error path at adding user-defined element set (git-fixes). - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes). - ALSA: fix kernel-doc markups (git-fixes). - ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes). - ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes). - ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes). - ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes). - ALSA: hda/realtek - Add supported mute Led for HP (git-fixes). - ALSA: hda/realtek - Enable headphone for ASUS TM420 (git-fixes). - ALSA: hda/realtek - Fixed HP headset Mic can't be detected (git-fixes). - ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes). - ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes). - ALSA: mixart: Fix mutex deadlock (git-fixes). - ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes). - ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes). - ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes). - ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 (git-fixes). - ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices (git-fixes). - arm64: bpf: Fix branch offset in JIT (git-fixes). - arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY (git-fixes). - arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node (git-fixes). - arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node (git-fixes). - arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay (git-fixes). - arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node (git-fixes). - arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node (git-fixes). - arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay (git-fixes). - arm64: dts: fsl: DPAA FMan DMA operations are coherent (git-fixes). - arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point (git-fixes). - arm64: dts: imx8mq: Add missing interrupts to GPC (git-fixes). - arm64: dts: imx8mq: Fix TMU interrupt property (git-fixes). - arm64: dts: zynqmp: Remove additional compatible string for i2c IPs (git-fixes). - arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions (git-fixes). - arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs (git-fixes). - arm64: Run ARCH_WORKAROUND_2 enabling code on all CPUs (git-fixes). - arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes (git-fixes). - arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes (git-fixes). - arm64: tegra: Add missing timeout clock to Tegra210 SDMMC (git-fixes). - arm64: vdso: Add '-Bsymbolic' to ldflags (git-fixes). - arm64: vdso: Add --eh-frame-hdr to ldflags (git-fixes). - ASoC: codecs: wcd9335: Set digital gain range correctly (git-fixes). - ASoC: cs42l51: manage mclk shutdown delay (git-fixes). - ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function (git-fixes). - ASoC: qcom: lpass-platform: Fix memory leak (git-fixes). - ASoC: qcom: sdm845: set driver name correctly (git-fixes). - ath10k: fix VHT NSS calculation when STBC is enabled (git-fixes). - ath10k: start recovery process when payload length exceeds max htc length for sdio (git-fixes). - batman-adv: set .owner to THIS_MODULE (git-fixes). - bnxt_en: Avoid sending firmware messages when AER error is detected (jsc#SLE-8371 bsc#1153274). - bnxt_en: Check abort error state in bnxt_open_nic() (jsc#SLE-8371 bsc#1153274). - bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task() (jsc#SLE-8371 bsc#1153274). - bnxt_en: Fix regression in workqueue cleanup logic in bnxt_remove_one() (jsc#SLE-8371 bsc#1153274). - bnxt_en: Invoke cancel_delayed_work_sync() for PFs also (jsc#SLE-8371 bsc#1153274). - bnxt_en: return proper error codes in bnxt_show_temp (git-fixes). - bnxt_en: Send HWRM_FUNC_RESET fw command unconditionally (jsc#SLE-8371 bsc#1153274). - bpf: Do not rely on GCC __attribute__((optimize)) to disable GCSE (bsc#1155518). - bpf: Fix comment for helper bpf_current_task_under_cgroup() (bsc#1155518). - bpf: Zero-fill re-used per-cpu map element (bsc#1155518). - btrfs: Account for merged patches upstream Move below patches to sorted section. - btrfs: cleanup cow block on error (bsc#1178584). - btrfs: fix bytes_may_use underflow in prealloc error condtition (bsc#1179217). - btrfs: fix metadata reservation for fallocate that leads to transaction aborts (bsc#1179217). - btrfs: fix relocation failure due to race with fallocate (bsc#1179217). - btrfs: remove item_size member of struct btrfs_clone_extent_info (bsc#1179217). - btrfs: rename btrfs_insert_clone_extent() to a more generic name (bsc#1179217). - btrfs: rename btrfs_punch_hole_range() to a more generic name (bsc#1179217). - btrfs: rename struct btrfs_clone_extent_info to a more generic name (bsc#1179217). - btrfs: reschedule if necessary when logging directory items (bsc#1178585). - btrfs: send, orphanize first all conflicting inodes when processing references (bsc#1178579). - btrfs: send, recompute reference path after orphanization of a directory (bsc#1178581). - can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes). - can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes). - can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (git-fixes). - can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (git-fixes). - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (git-fixes). - can: dev: can_restart(): post buffer from the right context (git-fixes). - can: flexcan: flexcan_remove(): disable wakeup completely (git-fixes). - can: flexcan: flexcan_setup_stop_mode(): add missing 'req_bit' to stop mode property comment (git-fixes). - can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A (git-fixes). - can: gs_usb: fix endianess problem with candleLight firmware (git-fixes). - can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits (git-fixes). - can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (git-fixes). - can: m_can: m_can_handle_state_change(): fix state change (git-fixes). - can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes). - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes). - can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on (git-fixes). - can: peak_usb: add range checking in decode operations (git-fixes). - can: peak_usb: fix potential integer overflow on shift of a int (git-fixes). - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping (git-fixes). - can: rx-offload: do not call kfree_skb() from IRQ context (git-fixes). - ceph: add check_session_state() helper and make it global (bsc#1179012). - ceph: check session state after bumping session->s_seq (bsc#1179012). - ceph: check the sesion state and return false in case it is closed (bsc#1179012). - ceph: downgrade warning from mdsmap decode to debug (bsc#1178653). - ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635). - cfg80211: initialize wdev data earlier (git-fixes). - cfg80211: regulatory: Fix inconsistent format argument (git-fixes). - cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211). - cifs: remove bogus debug code (bsc#1179427). - cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426). - clk: define to_clk_regmap() as inline function (git-fixes). - Convert trailing spaces and periods in path components (bsc#1179424). - cosa: Add missing kfree in error path of cosa_write (git-fixes). - dax: fix detection of dax support for non-persistent memory block devices (bsc#1171073). - dax: Fix stack overflow when mounting fsdax pmem device (bsc#1171073). - Delete patches.suse/fs-select.c-batch-user-writes-in-do_sys_poll.patch (bsc#1179419) - devlink: Make sure devlink instance and port are in same net namespace (bsc#1154353). - docs: ABI: sysfs-c2port: remove a duplicated entry (git-fixes). - Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU (bsc#1177353, bsc#1179076). - Do not create null.i000.ipa-clones file (bsc#1178330) Kbuild cc-option compiles /dev/null file to test for an option availability. Filter out -fdump-ipa-clones so that null.i000.ipa-clones file is not generated in the process. - drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873). - drivers/net/ethernet: remove incorrectly formatted doc (bsc#1177397). - drivers: watchdog: rdc321x_wdt: Fix race condition bugs (git-fixes). - Drop sysctl files for dropped archs, add ppc64le and arm (bsc#1178838). Also correct the page size on ppc64. - EDAC/amd64: Cache secondary Chip Select registers (bsc#1179001). - EDAC/amd64: Find Chip Select memory size using Address Mask (bsc#1179001). - EDAC/amd64: Gather hardware information early (bsc#1179001). - EDAC/amd64: Initialize DIMM info for systems with more than two channels (bsc#1179001). - EDAC/amd64: Make struct amd64_family_type global (bsc#1179001). - EDAC/amd64: Save max number of controllers to family type (bsc#1179001). - EDAC/amd64: Support asymmetric dual-rank DIMMs (bsc#1179001). - efi: add missed destroy_workqueue when efisubsys_init fails (git-fixes). - efi: efibc: check for efivars write capability (git-fixes). - efi: EFI_EARLYCON should depend on EFI (git-fixes). - efi/efivars: Set generic ops before loading SSDT (git-fixes). - efi/esrt: Fix reference count leak in esre_create_sysfs_entry (git-fixes). - efi/libstub/x86: Work around LLVM ELF quirk build regression (git-fixes). - efi: provide empty efi_enter_virtual_mode implementation (git-fixes). - efivarfs: fix memory leak in efivarfs_create() (git-fixes). - efivarfs: revert 'fix memory leak in efivarfs_create()' (git-fixes). - efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper (git-fixes). - efi/x86: Do not panic or BUG() on non-critical error conditions (git-fixes). - efi/x86: Fix the deletion of variables in mixed mode (git-fixes). - efi/x86: Free efi_pgd with free_pages() (git-fixes). - efi/x86: Handle by-ref arguments covering multiple pages in mixed mode (git-fixes). - efi/x86: Ignore the memory attributes table on i386 (git-fixes). - efi/x86: Map the entire EFI vendor string before copying it (git-fixes). - exfat: fix name_hash computation on big endian systems (git-fixes). - exfat: fix overflow issue in exfat_cluster_to_sector() (git-fixes). - exfat: fix possible memory leak in exfat_find() (git-fixes). - exfat: fix use of uninitialized spinlock on error path (git-fixes). - exfat: fix wrong hint_stat initialization in exfat_find_dir_entry() (git-fixes). - fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h (git-fixes). - Fix wrongly set CONFIG_SOUNDWIRE=y (bsc#1179201) CONFIG_SOUNDWIRE was mistakenly set as built-in. Mark it as module. - ftrace: Fix recursion check for NMI test (git-fixes). - ftrace: Handle tracing when switching between context (git-fixes). - futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1149032). - futex: Handle transient 'ownerless' rtmutex state correctly (bsc#1149032). - gpio: pcie-idio-24: Enable PEX8311 interrupts (git-fixes). - gpio: pcie-idio-24: Fix IRQ Enable Register value (git-fixes). - gpio: pcie-idio-24: Fix irq mask when masking (git-fixes). - HID: logitech-dj: Fix an error in mse_bluetooth_descriptor (git-fixes). - HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver (git-fixes). - HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad (git-fixes). - HID: logitech-hidpp: Add PID for MX Anywhere 2 (git-fixes). - hv_balloon: disable warning when floor reached (git-fixes). - hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() functions (git-fixes). - hv_netvsc: Add XDP support (bsc#1177820). - hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177820). - hv_netvsc: make recording RSS hash depend on feature flag (bsc#1177820). - hv_netvsc: record hardware hash in skb (bsc#1177820). - hwmon: (pwm-fan) Fix RPM calculation (git-fixes). - hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306). - i2c: mediatek: move dma reset before i2c reset (git-fixes). - i2c: sh_mobile: implement atomic transfers (git-fixes). - igc: Fix not considering the TX delay for timestamps (bsc#1160634). - igc: Fix wrong timestamp latency numbers (bsc#1160634). - iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (git-fixes). - iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (git-fixes). - iio: adc: mediatek: fix unset field (git-fixes). - iio: light: fix kconfig dependency bug for VCNL4035 (git-fixes). - Input: adxl34x - clean up a data type in adxl34x_probe() (git-fixes). - Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER (git-fixes). - intel_idle: Customize IceLake server support (bsc#1178286). - ionic: check port ptr before use (bsc#1167773). - iwlwifi: mvm: write queue_sync_state only for sync (git-fixes). - kABI: revert use_mm name change (MM Functionality, bsc#1178426). - kABI workaround for HD-audio (git-fixes). - kernel: better document the use_mm/unuse_mm API contract (MM Functionality, bsc#1178426). - kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082) - kernel-source.spec: Fix build with rpm 4.16 (boo#1179015). RPM_BUILD_ROOT is cleared before %%install. Do the unpack into RPM_BUILD_ROOT in %%install - kernel/watchdog: fix watchdog_allowed_mask not used warning (git-fixes). - kgdb: Fix spurious true from in_dbg_master() (git-fixes). - kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled (git-fixes). - KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 does not return SMCCC_RET_NOT_REQUIRED (git-fixes). - lan743x: fix 'BUG: invalid wait context' when setting rx mode (git-fixes). - lan743x: fix issue causing intermittent kernel log warnings (git-fixes). - lan743x: prevent entire kernel HANG on open, for some platforms (git-fixes). - leds: bcm6328, bcm6358: use devres LED registering function (git-fixes). - libbpf, hashmap: Fix undefined behavior in hash_bits (bsc#1155518). - libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873). - lib/crc32test: remove extra local_irq_disable/enable (git-fixes). - libnvdimm/nvdimm/flush: Allow architecture to override the flush barrier (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - lib/strncpy_from_user.c: Mask out bytes after NUL terminator (bsc#1155518). - mac80211: always wind down STA state (git-fixes). - mac80211: fix use of skb payload instead of header (git-fixes). - mac80211: free sta in sta_info_insert_finish() on errors (git-fixes). - mac80211: minstrel: fix tx status processing corner case (git-fixes). - mac80211: minstrel: remove deferred sampling code (git-fixes). - media: imx274: fix frame interval handling (git-fixes). - media: platform: Improve queue set up flow for bug fixing (git-fixes). - media: tw5864: check status of tw5864_frameinterval_get (git-fixes). - media: uvcvideo: Fix dereference of out-of-bound list iterator (git-fixes). - media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect (git-fixes). - mei: protect mei_cl_mtu from null dereference (git-fixes). - memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event (bsc#1177703). - mfd: sprd: Add wakeup capability for PMIC IRQ (git-fixes). - mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove (git-fixes). - mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs (git-fixes). - mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers (git-fixes). - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race (MM Functionality, bsc#1178426). - mm: fix kthread_use_mm() vs TLB invalidate (MM Functionality, bsc#1178426). - mm/gup: allow FOLL_FORCE for get_user_pages_fast() (git fixes (mm/gup)). - mm/gup: fix gup_fast with dynamic page table folding (bnc#1176586, LTC#188235). - mm/ksm: fix NULL pointer dereference when KSM zero page is enabled (git fixes (mm/ksm)). - mm, memcg: fix inconsistent oom event behavior (bsc#1178659). - mm/memcg: fix refcount error while moving and swapping (bsc#1178686). - mm/memcontrol.c: add missed css_put() (bsc#1178661). - mm: mempolicy: require at least one nodeid for MPOL_PREFERRED (git fixes (mm/mempolicy)). - mm/swapfile.c: fix potential memory leak in sys_swapon (git-fixes). - mm: swap: make page_evictable() inline (git fixes (mm/vmscan)). - mm: swap: use smp_mb__after_atomic() to order LRU bit set (git fixes (mm/vmscan)). - mm, THP, swap: fix allocating cluster for swapfile by mistake (bsc#1178755). - modsign: Add codeSigning EKU when generating X.509 key generation config (bsc#1177353, bsc#1179076). - net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send (bsc#1172873). - net: ena: Capitalize all log strings and improve code readability (bsc#1177397). - net: ena: Change license into format to SPDX in all files (bsc#1177397). - net: ena: Change log message to netif/dev function (bsc#1177397). - net: ena: Change RSS related macros and variables names (bsc#1177397). - net: ena: ethtool: Add new device statistics (bsc#1177397). - net: ena: ethtool: add stats printing to XDP queues (bsc#1177397). - net: ena: ethtool: convert stat_offset to 64 bit resolution (bsc#1177397). - net: ena: Fix all static chekers' warnings (bsc#1177397). - net: ena: fix packet's addresses for rx_offset feature (bsc#1174852). - net: ena: handle bad request id in ena_netdev (bsc#1174852). - net: ena: Remove redundant print of placement policy (bsc#1177397). - net: ena: xdp: add queue counters for xdp actions (bsc#1177397). - net: fix pos incrementment in ipv6_route_seq_next (bsc#1154353). - net: introduce helper sendpage_ok() in include/linux/net.h (bsc#1172873). kABI workaround for including mm.h in include/linux/net.h (bsc#1172873). - net/mlx5: Clear bw_share upon VF disable (jsc#SLE-8464). - net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled (jsc#SLE-8464). - net: mscc: ocelot: fix race condition with TX timestamping (bsc#1178461). - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition (git-fixes). - nfc: s3fwrn5: use signed integer for parsing GPIO numbers (git-fixes). - NFS: only invalidate dentrys that are clearly invalid (bsc#1178669 bsc#1170139). - NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE (bsc#1176180). - NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE (bsc#1176180). - NFSv4.x recover from pre-mature loss of openstateid (bsc#1176180). - nvme: do not update disk info for multipathed device (bsc#1171558). - nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() (bsc#1172873). - p54: avoid accessing the data mapped to streaming DMA (git-fixes). - PCI/ACPI: Whitelist hotplug ports for D3 if power managed by ACPI (git-fixes). - pinctrl: amd: fix incorrect way to disable debounce filter (git-fixes). - pinctrl: amd: use higher precision for 512 RtcClk (git-fixes). - pinctrl: aspeed: Fix GPI only function problem (git-fixes). - pinctrl: intel: Set default bias in case no particular value given (git-fixes). - platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time (git-fixes). - platform/x86: toshiba_acpi: Fix the wrong variable assignment (git-fixes). - PM: runtime: Drop runtime PM references to supplier on link removal (git-fixes). - powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm (MM Functionality, bsc#1178426). - powerpc: Inline doorbell sending functions (jsc#SLE-15869 jsc#SLE-16321). - powerpc/perf: consolidate GPCI hcall structs into asm/hvcall.h (jsc#SLE-16360 jsc#SLE-16915). - powerpc/pmem: Add flush routines using new pmem store and sync instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Add new instructions for persistent storage and sync (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Avoid the barrier in flush routines (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Initialize pmem device on newer hardware (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Restrict papr_scm to P8 and above (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pmem: Update ppc64 to use the new barrier instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964). - powerpc/pseries: Add KVM guest doorbell restrictions (jsc#SLE-15869 jsc#SLE-16321). - powerpc/pseries: new lparcfg key/value pair: partition_affinity_score (jsc#SLE-16360 jsc#SLE-16915). - powerpc/pseries: Use doorbells even if XIVE is available (jsc#SLE-15869 jsc#SLE-16321). - powerpc: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM (MM Functionality, bsc#1178426). - powerpc/vnic: Extend 'failover pending' window (bsc#1176855 ltc#187293). - power: supply: bq27xxx: report 'not charging' on all types (git-fixes). - power: supply: test_power: add missing newlines when printing parameters by sysfs (git-fixes). - qla2xxx: Add MODULE_VERSION back to driver (bsc#1179160). - RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP (jsc#SLE-8449). - RDMA/hns: Fix the wrong value of rnr_retry when querying qp (jsc#SLE-8449). - RDMA/hns: Fix wrong field of SRQ number the device supports (jsc#SLE-8449). - RDMA/hns: Solve the overflow of the calc_pg_sz() (jsc#SLE-8449). - RDMA/mlx5: Fix devlink deadlock on net namespace deletion (jsc#SLE-8464). - RDMA/qedr: Fix return code if accept is called on a destroyed qp (jsc#SLE-8215). - RDMA/ucma: Add missing locking around rdma_leave_multicast() (git-fixes). - reboot: fix overflow parsing reboot cpu number (git-fixes). - Refresh patches.suse/vfs-add-super_operations-get_inode_dev. (bsc#1176983) - regulator: avoid resolve_supply() infinite recursion (git-fixes). - regulator: defer probe when trying to get voltage from unresolved supply (git-fixes). - regulator: fix memory leak with repeated set_machine_constraints() (git-fixes). - regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} (git-fixes). - regulator: ti-abb: Fix array out of bound read access on the first transition (git-fixes). - regulator: workaround self-referent regulators (git-fixes). - Restore the header of series.conf The header of series.conf was accidentally changed by abb50be8e6bc '(kABI: revert use_mm name change (MM Functionality, bsc#1178426))'. - Revert 'cdc-acm: hardening against malicious devices' (git-fixes). - Revert 'kernel/reboot.c: convert simple_strtoul to kstrtoint' (git-fixes). - Revert 'xfs: complain if anyone tries to create a too-large buffer' (bsc#1179425, bsc#1179550). - rfkill: Fix use-after-free in rfkill_resume() (git-fixes). - ring-buffer: Fix recursion protection transitions between interrupt context (git-fixes). - rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014) Author: Dominique Leuenberger -<dimstar@opensuse.org> - rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014) %split_extra still contained two. - rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045) egrep is only a deprecated bash wrapper for 'grep -E'. So use the latter instead. - rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401) - rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082). - rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one). There is: ExportFilter: ^kernel-obs-build.*\.x86_64.rpm$ . i586 in Factory's prjconf now. No other actively maintained distro (i.e. merging packaging branch) builds a x86_32 kernel, hence pushing to packaging directly. - s390/bpf: Fix multiple tail calls (git-fixes). - s390/cpum_cf,perf: change DFLT_CCERROR counter name (bsc#1175918 LTC#187935). - s390/cpum_sf.c: fix file permission for cpum_sfb_size (git-fixes). - s390/dasd: fix null pointer dereference for ERP requests (git-fixes). - s390/pkey: fix paes selftest failure with paes and pkey static build (git-fixes). - s390/zcrypt: fix kmalloc 256k failure (bsc#1177066 LTC#188341). - s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl (bsc#1177070 LTC#188342). - sched/fair: Ensure tasks spreading in LLC during LB (git fixes (sched)). - sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list (git fixes (sched)). - sched: Fix loadavg accounting race on arm64 kabi (bnc#1178227). - sched: Fix rq->nr_iowait ordering (git fixes (sched)). - scripts/lib/SUSE/MyBS.pm: properly close prjconf Macros: section - scsi: libiscsi: Fix NOP race condition (bsc#1176481). - scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() (bsc#1172873). - serial: 8250_mtk: Fix uart_get_baud_rate warning (git-fixes). - serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init (git-fixes). - spi: lpspi: Fix use-after-free on unbind (git-fixes). - staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice (git-fixes). - staging: octeon: Drop on uncorrectable alignment or FCS error (git-fixes). - staging: octeon: repair 'fixed-link' support (git-fixes). - staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (git-fixes). - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (bsc#1154353). - SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow() (git-fixes). - svcrdma: fix bounce buffers for unaligned offsets and multiple pages (git-fixes). - tcp: use sendpage_ok() to detect misused .sendpage (bsc#1172873). - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() (git-fixes). - thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() (git-fixes). - timer: Fix wheel index calculation on last level (git-fixes). - timer: Prevent base->clk from moving backward (git-fixes). - tpm: efi: Do not create binary_bios_measurements file for an empty log (git-fixes). - tpm_tis: Disable interrupts on ThinkPad T490s (git-fixes). - tracing: Fix out of bounds write in get_trace_buf (git-fixes). - tty: serial: fsl_lpuart: add LS1028A support (git-fixes). - tty: serial: fsl_lpuart: LS1021A had a FIFO size of 16 words, like LS1028A (git-fixes). - tty: serial: imx: fix potential deadlock (git-fixes). - tty: serial: imx: keep console clocks always on (git-fixes). - uio: Fix use-after-free in uio_unregister_device() (git-fixes). - uio: free uio id after uio file node is freed (git-fixes). - USB: Add NO_LPM quirk for Kingston flash drive (git-fixes). - USB: adutux: fix debugging (git-fixes). - USB: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (git-fixes). - USB: cdc-acm: fix cooldown mechanism (git-fixes). - USB: core: Change %pK for __user pointers to %px (git-fixes). - USB: core: driver: fix stray tabs in error messages (git-fixes). - USB: core: Fix regression in Hercules audio card (git-fixes). - USB: gadget: Fix memleak in gadgetfs_fill_super (git-fixes). - USB: gadget: f_midi: Fix memleak in f_midi_alloc (git-fixes). - USB: gadget: goku_udc: fix potential crashes in probe (git-fixes). - USB: host: fsl-mph-dr-of: check return of dma_set_mask() (git-fixes). - USB: mtu3: fix panic in mtu3_gadget_stop() (git-fixes). - USB: serial: cyberjack: fix write-URB completion race (git-fixes). - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 (git-fixes). - USB: serial: option: add Quectel EC200T module support (git-fixes). - USB: serial: option: add Telit FN980 composition 0x1055 (git-fixes). - USB: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart (git-fixes). - USB: typec: tcpm: reset hard_reset_count for any disconnect (git-fixes). - USB: xhci: omit duplicate actions when suspending a runtime suspended host (git-fixes). - video: hyperv_fb: Fix the cache type when mapping the VRAM (git-fixes). - video: hyperv_fb: include vmalloc.h (git-fixes). - video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host (bsc#1175306). - video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (bsc#1175306). - video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs (bsc#1175306). - virtio: virtio_console: fix DMA memory allocation for rproc serial (git-fixes). - vt: Disable KD_FONT_OP_COPY (bsc#1178589). - x86/hyperv: Clarify comment on x2apic mode (git-fixes). - x86/i8259: Use printk_deferred() to prevent deadlock (git-fixes). - x86/kexec: Use up-to-dated screen_info copy to fill boot params (bsc#1175306). - x86/microcode/intel: Check patch signature before saving microcode for early loading (bsc#1152489). - x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (bsc#1152489). - xfs: complain if anyone tries to create a too-large buffer log item (bsc#1166146). - xfs: do not update mtime on COW faults (bsc#1167030). - xfs: fix a missing unlock on error in xfs_fs_map_blocks (git-fixes). - xfs: fix brainos in the refcount scrubber's rmap fragment processor (git-fixes). - xfs: fix flags argument to rmap lookup when converting shared file rmaps (git-fixes). - xfs: fix rmap key and record comparison functions (git-fixes). - xfs: fix scrub flagging rtinherit even if there is no rt device (git-fixes). - xfs: flush new eof page on truncate to avoid post-eof corruption (git-fixes). - xfs: introduce XFS_MAX_FILEOFF (bsc#1166166). - xfs: prohibit fs freezing when using empty transactions (bsc#1179442). - xfs: remove unused variable 'done' (bsc#1166166). - xfs: revert 'xfs: fix rmap key and record comparison functions' (git-fixes). - xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents (git-fixes). - xfs: set xefi_discard when creating a deferred agfl free log intent item (git-fixes). - xfs: truncate should remove all blocks, not just to the end of the page cache (bsc#1166166). - xhci: Fix sizeof() mismatch (git-fixes). - xhci: hisilicon: fix refercence leak in xhci_histb_probe (git-fixes). kernel-default-base fixes the following issues: - Add wireguard kernel module (bsc#1179225) - Create the list of crypto kernel modules dynamically, supersedes hardcoded list of crc32 implementations (bsc#1177577) This update was imported from the SUSE:SLE-15-SP2:Update update project.

Patchnames: openSUSE-2020-2260

CVE-2020-15436

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-15437

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-25668

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-25669

4.3 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-25704

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-27777

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-28915

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-28941

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-28974

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-29369

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

CVE-2020-29371

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact low

CVE-2020-4788

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64		—	Vendor Fix

Threats

Impact moderate

References

133 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://lists.opensuse.org/archives/list/security…	self
https://lists.opensuse.org/archives/list/security…	self
https://bugzilla.suse.com/1149032	self
https://bugzilla.suse.com/1152489	self
https://bugzilla.suse.com/1153274	self
https://bugzilla.suse.com/1154353	self
https://bugzilla.suse.com/1155518	self
https://bugzilla.suse.com/1160634	self
https://bugzilla.suse.com/1166146	self
https://bugzilla.suse.com/1166166	self
https://bugzilla.suse.com/1167030	self
https://bugzilla.suse.com/1167773	self
https://bugzilla.suse.com/1170139	self
https://bugzilla.suse.com/1171073	self
https://bugzilla.suse.com/1171558	self
https://bugzilla.suse.com/1172873	self
https://bugzilla.suse.com/1173504	self
https://bugzilla.suse.com/1174852	self
https://bugzilla.suse.com/1175306	self
https://bugzilla.suse.com/1175918	self
https://bugzilla.suse.com/1176109	self
https://bugzilla.suse.com/1176180	self
https://bugzilla.suse.com/1176200	self
https://bugzilla.suse.com/1176481	self
https://bugzilla.suse.com/1176586	self
https://bugzilla.suse.com/1176855	self
https://bugzilla.suse.com/1176983	self
https://bugzilla.suse.com/1177066	self
https://bugzilla.suse.com/1177070	self
https://bugzilla.suse.com/1177353	self
https://bugzilla.suse.com/1177397	self
https://bugzilla.suse.com/1177577	self
https://bugzilla.suse.com/1177666	self
https://bugzilla.suse.com/1177703	self
https://bugzilla.suse.com/1177820	self
https://bugzilla.suse.com/1178123	self
https://bugzilla.suse.com/1178182	self
https://bugzilla.suse.com/1178227	self
https://bugzilla.suse.com/1178286	self
https://bugzilla.suse.com/1178304	self
https://bugzilla.suse.com/1178330	self
https://bugzilla.suse.com/1178393	self
https://bugzilla.suse.com/1178401	self
https://bugzilla.suse.com/1178426	self
https://bugzilla.suse.com/1178461	self
https://bugzilla.suse.com/1178579	self
https://bugzilla.suse.com/1178581	self
https://bugzilla.suse.com/1178584	self
https://bugzilla.suse.com/1178585	self
https://bugzilla.suse.com/1178589	self
https://bugzilla.suse.com/1178635	self
https://bugzilla.suse.com/1178653	self
https://bugzilla.suse.com/1178659	self
https://bugzilla.suse.com/1178661	self
https://bugzilla.suse.com/1178669	self
https://bugzilla.suse.com/1178686	self
https://bugzilla.suse.com/1178740	self
https://bugzilla.suse.com/1178755	self
https://bugzilla.suse.com/1178762	self
https://bugzilla.suse.com/1178838	self
https://bugzilla.suse.com/1178853	self
https://bugzilla.suse.com/1178886	self
https://bugzilla.suse.com/1179001	self
https://bugzilla.suse.com/1179012	self
https://bugzilla.suse.com/1179014	self
https://bugzilla.suse.com/1179015	self
https://bugzilla.suse.com/1179045	self
https://bugzilla.suse.com/1179076	self
https://bugzilla.suse.com/1179082	self
https://bugzilla.suse.com/1179107	self
https://bugzilla.suse.com/1179140	self
https://bugzilla.suse.com/1179141	self
https://bugzilla.suse.com/1179160	self
https://bugzilla.suse.com/1179201	self
https://bugzilla.suse.com/1179211	self
https://bugzilla.suse.com/1179217	self
https://bugzilla.suse.com/1179225	self
https://bugzilla.suse.com/1179419	self
https://bugzilla.suse.com/1179424	self
https://bugzilla.suse.com/1179425	self
https://bugzilla.suse.com/1179426	self
https://bugzilla.suse.com/1179427	self
https://bugzilla.suse.com/1179429	self
https://bugzilla.suse.com/1179432	self
https://bugzilla.suse.com/1179442	self
https://bugzilla.suse.com/1179550	self
https://www.suse.com/security/cve/CVE-2020-15436/	self
https://www.suse.com/security/cve/CVE-2020-15437/	self
https://www.suse.com/security/cve/CVE-2020-25668/	self
https://www.suse.com/security/cve/CVE-2020-25669/	self
https://www.suse.com/security/cve/CVE-2020-25704/	self
https://www.suse.com/security/cve/CVE-2020-27777/	self
https://www.suse.com/security/cve/CVE-2020-28915/	self
https://www.suse.com/security/cve/CVE-2020-28941/	self
https://www.suse.com/security/cve/CVE-2020-28974/	self
https://www.suse.com/security/cve/CVE-2020-29369/	self
https://www.suse.com/security/cve/CVE-2020-29371/	self
https://www.suse.com/security/cve/CVE-2020-4788/	self
https://www.suse.com/security/cve/CVE-2020-15436	external
https://bugzilla.suse.com/1179141	external
https://www.suse.com/security/cve/CVE-2020-15437	external
https://bugzilla.suse.com/1179140	external
https://www.suse.com/security/cve/CVE-2020-25668	external
https://bugzilla.suse.com/1178123	external
https://bugzilla.suse.com/1178622	external
https://bugzilla.suse.com/1196914	external
https://www.suse.com/security/cve/CVE-2020-25669	external
https://bugzilla.suse.com/1178182	external
https://www.suse.com/security/cve/CVE-2020-25704	external
https://bugzilla.suse.com/1178393	external
https://www.suse.com/security/cve/CVE-2020-27777	external
https://bugzilla.suse.com/1179107	external
https://bugzilla.suse.com/1179419	external
https://bugzilla.suse.com/1200343	external
https://bugzilla.suse.com/1220060	external
https://www.suse.com/security/cve/CVE-2020-28915	external
https://bugzilla.suse.com/1178886	external
https://www.suse.com/security/cve/CVE-2020-28941	external
https://bugzilla.suse.com/1178740	external
https://www.suse.com/security/cve/CVE-2020-28974	external
https://bugzilla.suse.com/1178589	external
https://www.suse.com/security/cve/CVE-2020-29369	external
https://bugzilla.suse.com/1173504	external
https://bugzilla.suse.com/1179432	external
https://bugzilla.suse.com/1179646	external
https://bugzilla.suse.com/1182109	external
https://www.suse.com/security/cve/CVE-2020-29371	external
https://bugzilla.suse.com/1179429	external
https://www.suse.com/security/cve/CVE-2020-4788	external
https://bugzilla.suse.com/1177666	external
https://bugzilla.suse.com/1181158	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "The SUSE Linux Enterprise 15 SP2 kernel was updated to 3.12.31 to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).\n- CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).\n- CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).\n- CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).\n- CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).\n- CVE-2020-27777: Restrict RTAS requests from userspace  (bsc#1179107)\n- CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).\n- CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).\n- CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).\n- CVE-2020-25705: Fixed an issue which could have allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization (bsc#1175721).\n- CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740).\n- CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).\n- CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 1179432).\n\nThe following non-security bugs were fixed:\n\n\n- 9P: Cast to loff_t before multiplying (git-fixes).\n- ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).\n- ACPICA: Add NHLT table signature (bsc#1176200).\n- ACPI: dock: fix enum-conversion warning (git-fixes).\n- ACPI / extlog: Check for RDMSR failure (git-fixes).\n- ACPI: GED: fix -Wformat (git-fixes).\n- ACPI: NFIT: Fix comparison to \u0027-ENXIO\u0027 (git-fixes).\n- ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).\n- Add bug reference to two hv_netvsc patches (bsc#1178853).\n- ALSA: ctl: fix error path at adding user-defined element set (git-fixes).\n- ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).\n- ALSA: fix kernel-doc markups (git-fixes).\n- ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).\n- ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).\n- ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).\n- ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).\n- ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).\n- ALSA: hda/realtek - Enable headphone for ASUS TM420 (git-fixes).\n- ALSA: hda/realtek - Fixed HP headset Mic can\u0027t be detected (git-fixes).\n- ALSA: hda/realtek - HP Headset Mic can\u0027t detect after boot (git-fixes).\n- ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).\n- ALSA: mixart: Fix mutex deadlock (git-fixes).\n- ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).\n- ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 (git-fixes).\n- ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices (git-fixes).\n- arm64: bpf: Fix branch offset in JIT (git-fixes).\n- arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY (git-fixes).\n- arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node (git-fixes).\n- arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node (git-fixes).\n- arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay (git-fixes).\n- arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node (git-fixes).\n- arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node (git-fixes).\n- arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay (git-fixes).\n- arm64: dts: fsl: DPAA FMan DMA operations are coherent (git-fixes).\n- arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point (git-fixes).\n- arm64: dts: imx8mq: Add missing interrupts to GPC (git-fixes).\n- arm64: dts: imx8mq: Fix TMU interrupt property (git-fixes).\n- arm64: dts: zynqmp: Remove additional compatible string for i2c IPs (git-fixes).\n- arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions (git-fixes).\n- arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs (git-fixes).\n- arm64: Run ARCH_WORKAROUND_2 enabling code on all CPUs (git-fixes).\n- arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes (git-fixes).\n- arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes (git-fixes).\n- arm64: tegra: Add missing timeout clock to Tegra210 SDMMC (git-fixes).\n- arm64: vdso: Add \u0027-Bsymbolic\u0027 to ldflags (git-fixes).\n- arm64: vdso: Add --eh-frame-hdr to ldflags (git-fixes).\n- ASoC: codecs: wcd9335: Set digital gain range correctly (git-fixes).\n- ASoC: cs42l51: manage mclk shutdown delay (git-fixes).\n- ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function (git-fixes).\n- ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).\n- ASoC: qcom: sdm845: set driver name correctly (git-fixes).\n- ath10k: fix VHT NSS calculation when STBC is enabled (git-fixes).\n- ath10k: start recovery process when payload length exceeds max htc length for sdio (git-fixes).\n- batman-adv: set .owner to THIS_MODULE (git-fixes).\n- bnxt_en: Avoid sending firmware messages when AER error is detected (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Check abort error state in bnxt_open_nic() (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task() (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Fix regression in workqueue cleanup logic in bnxt_remove_one() (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: Invoke cancel_delayed_work_sync() for PFs also (jsc#SLE-8371 bsc#1153274).\n- bnxt_en: return proper error codes in bnxt_show_temp (git-fixes).\n- bnxt_en: Send HWRM_FUNC_RESET fw command unconditionally (jsc#SLE-8371 bsc#1153274).\n- bpf: Do not rely on GCC __attribute__((optimize)) to disable GCSE (bsc#1155518).\n- bpf: Fix comment for helper bpf_current_task_under_cgroup() (bsc#1155518).\n- bpf: Zero-fill re-used per-cpu map element (bsc#1155518).\n- btrfs: Account for merged patches upstream Move below patches to sorted section.\n- btrfs: cleanup cow block on error (bsc#1178584).\n- btrfs: fix bytes_may_use underflow in prealloc error condtition (bsc#1179217).\n- btrfs: fix metadata reservation for fallocate that leads to transaction aborts (bsc#1179217).\n- btrfs: fix relocation failure due to race with fallocate (bsc#1179217).\n- btrfs: remove item_size member of struct btrfs_clone_extent_info (bsc#1179217).\n- btrfs: rename btrfs_insert_clone_extent() to a more generic name (bsc#1179217).\n- btrfs: rename btrfs_punch_hole_range() to a more generic name (bsc#1179217).\n- btrfs: rename struct btrfs_clone_extent_info to a more generic name (bsc#1179217).\n- btrfs: reschedule if necessary when logging directory items (bsc#1178585).\n- btrfs: send, orphanize first all conflicting inodes when processing references (bsc#1178579).\n- btrfs: send, recompute reference path after orphanization of a directory (bsc#1178581).\n- can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).\n- can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).\n- can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (git-fixes).\n- can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (git-fixes).\n- can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (git-fixes).\n- can: dev: can_restart(): post buffer from the right context (git-fixes).\n- can: flexcan: flexcan_remove(): disable wakeup completely (git-fixes).\n- can: flexcan: flexcan_setup_stop_mode(): add missing \u0027req_bit\u0027 to stop mode property comment (git-fixes).\n- can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A (git-fixes).\n- can: gs_usb: fix endianess problem with candleLight firmware (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits (git-fixes).\n- can: m_can: fix nominal bitiming tseg2 min for version \u003e= 3.1 (git-fixes).\n- can: m_can: m_can_handle_state_change(): fix state change (git-fixes).\n- can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes).\n- can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes).\n- can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on (git-fixes).\n- can: peak_usb: add range checking in decode operations (git-fixes).\n- can: peak_usb: fix potential integer overflow on shift of a int (git-fixes).\n- can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping (git-fixes).\n- can: rx-offload: do not call kfree_skb() from IRQ context (git-fixes).\n- ceph: add check_session_state() helper and make it global (bsc#1179012).\n- ceph: check session state after bumping session-\u003es_seq (bsc#1179012).\n- ceph: check the sesion state and return false in case it is closed (bsc#1179012).\n- ceph: downgrade warning from mdsmap decode to debug (bsc#1178653).\n- ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635).\n- cfg80211: initialize wdev data earlier (git-fixes).\n- cfg80211: regulatory: Fix inconsistent format argument (git-fixes).\n- cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211).\n- cifs: remove bogus debug code (bsc#1179427).\n- cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426).\n- clk: define to_clk_regmap() as inline function (git-fixes).\n- Convert trailing spaces and periods in path components (bsc#1179424).\n- cosa: Add missing kfree in error path of cosa_write (git-fixes).\n- dax: fix detection of dax support for non-persistent memory block devices (bsc#1171073).\n- dax: Fix stack overflow when mounting fsdax pmem device (bsc#1171073).\n- Delete patches.suse/fs-select.c-batch-user-writes-in-do_sys_poll.patch (bsc#1179419)\n- devlink: Make sure devlink instance and port are in same net namespace (bsc#1154353).\n- docs: ABI: sysfs-c2port: remove a duplicated entry (git-fixes).\n- Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU (bsc#1177353, bsc#1179076).\n- Do not create null.i000.ipa-clones file (bsc#1178330) Kbuild cc-option compiles /dev/null file to test for an option availability. Filter out -fdump-ipa-clones so that null.i000.ipa-clones file is not generated in the process.\n- drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873).\n- drivers/net/ethernet: remove incorrectly formatted doc (bsc#1177397).\n- drivers: watchdog: rdc321x_wdt: Fix race condition bugs (git-fixes).\n- Drop sysctl files for dropped archs, add ppc64le and arm (bsc#1178838). Also correct the page size on ppc64.\n- EDAC/amd64: Cache secondary Chip Select registers (bsc#1179001).\n- EDAC/amd64: Find Chip Select memory size using Address Mask (bsc#1179001).\n- EDAC/amd64: Gather hardware information early (bsc#1179001).\n- EDAC/amd64: Initialize DIMM info for systems with more than two channels (bsc#1179001).\n- EDAC/amd64: Make struct amd64_family_type global (bsc#1179001).\n- EDAC/amd64: Save max number of controllers to family type (bsc#1179001). \n- EDAC/amd64: Support asymmetric dual-rank DIMMs (bsc#1179001).\n- efi: add missed destroy_workqueue when efisubsys_init fails (git-fixes).\n- efi: efibc: check for efivars write capability (git-fixes).\n- efi: EFI_EARLYCON should depend on EFI (git-fixes).\n- efi/efivars: Set generic ops before loading SSDT (git-fixes).\n- efi/esrt: Fix reference count leak in esre_create_sysfs_entry (git-fixes).\n- efi/libstub/x86: Work around LLVM ELF quirk build regression (git-fixes).\n- efi: provide empty efi_enter_virtual_mode implementation (git-fixes).\n- efivarfs: fix memory leak in efivarfs_create() (git-fixes).\n- efivarfs: revert \u0027fix memory leak in efivarfs_create()\u0027 (git-fixes).\n- efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper (git-fixes).\n- efi/x86: Do not panic or BUG() on non-critical error conditions (git-fixes).\n- efi/x86: Fix the deletion of variables in mixed mode (git-fixes).\n- efi/x86: Free efi_pgd with free_pages() (git-fixes).\n- efi/x86: Handle by-ref arguments covering multiple pages in mixed mode (git-fixes).\n- efi/x86: Ignore the memory attributes table on i386 (git-fixes).\n- efi/x86: Map the entire EFI vendor string before copying it (git-fixes).\n- exfat: fix name_hash computation on big endian systems (git-fixes).\n- exfat: fix overflow issue in exfat_cluster_to_sector() (git-fixes).\n- exfat: fix possible memory leak in exfat_find() (git-fixes).\n- exfat: fix use of uninitialized spinlock on error path (git-fixes).\n- exfat: fix wrong hint_stat initialization in exfat_find_dir_entry() (git-fixes).\n- fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h (git-fixes).\n- Fix wrongly set CONFIG_SOUNDWIRE=y (bsc#1179201) CONFIG_SOUNDWIRE was mistakenly set as built-in. Mark it as module.\n- ftrace: Fix recursion check for NMI test (git-fixes).\n- ftrace: Handle tracing when switching between context (git-fixes).\n- futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1149032).\n- futex: Handle transient \u0027ownerless\u0027 rtmutex state correctly (bsc#1149032).\n- gpio: pcie-idio-24: Enable PEX8311 interrupts (git-fixes).\n- gpio: pcie-idio-24: Fix IRQ Enable Register value (git-fixes).\n- gpio: pcie-idio-24: Fix irq mask when masking (git-fixes).\n- HID: logitech-dj: Fix an error in mse_bluetooth_descriptor (git-fixes).\n- HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver (git-fixes).\n- HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad (git-fixes).\n- HID: logitech-hidpp: Add PID for MX Anywhere 2 (git-fixes).\n- hv_balloon: disable warning when floor reached (git-fixes).\n- hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() functions (git-fixes).\n- hv_netvsc: Add XDP support (bsc#1177820).\n- hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177820).\n- hv_netvsc: make recording RSS hash depend on feature flag (bsc#1177820).\n- hv_netvsc: record hardware hash in skb (bsc#1177820).\n- hwmon: (pwm-fan) Fix RPM calculation (git-fixes).\n- hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).\n- i2c: mediatek: move dma reset before i2c reset (git-fixes).\n- i2c: sh_mobile: implement atomic transfers (git-fixes).\n- igc: Fix not considering the TX delay for timestamps (bsc#1160634).\n- igc: Fix wrong timestamp latency numbers (bsc#1160634).\n- iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode (git-fixes).\n- iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum (git-fixes).\n- iio: adc: mediatek: fix unset field (git-fixes).\n- iio: light: fix kconfig dependency bug for VCNL4035 (git-fixes).\n- Input: adxl34x - clean up a data type in adxl34x_probe() (git-fixes).\n- Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER (git-fixes).\n- intel_idle: Customize IceLake server support (bsc#1178286).\n- ionic: check port ptr before use (bsc#1167773).\n- iwlwifi: mvm: write queue_sync_state only for sync (git-fixes).\n- kABI: revert use_mm name change (MM Functionality, bsc#1178426).\n- kABI workaround for HD-audio (git-fixes).\n- kernel: better document the use_mm/unuse_mm API contract (MM Functionality, bsc#1178426).\n- kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082)\n- kernel-source.spec: Fix build with rpm 4.16 (boo#1179015). RPM_BUILD_ROOT is cleared before %%install. Do the unpack into RPM_BUILD_ROOT in %%install\n- kernel/watchdog: fix watchdog_allowed_mask not used warning (git-fixes).\n- kgdb: Fix spurious true from in_dbg_master() (git-fixes).\n- kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled (git-fixes).\n- KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 does not return SMCCC_RET_NOT_REQUIRED (git-fixes).\n- lan743x: fix \u0027BUG: invalid wait context\u0027 when setting rx mode (git-fixes).\n- lan743x: fix issue causing intermittent kernel log warnings (git-fixes).\n- lan743x: prevent entire kernel HANG on open, for some platforms (git-fixes).\n- leds: bcm6328, bcm6358: use devres LED registering function (git-fixes).\n- libbpf, hashmap: Fix undefined behavior in hash_bits (bsc#1155518).\n- libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873).\n- lib/crc32test: remove extra local_irq_disable/enable (git-fixes).\n- libnvdimm/nvdimm/flush: Allow architecture to override the flush barrier (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- lib/strncpy_from_user.c: Mask out bytes after NUL terminator (bsc#1155518).\n- mac80211: always wind down STA state (git-fixes).\n- mac80211: fix use of skb payload instead of header (git-fixes).\n- mac80211: free sta in sta_info_insert_finish() on errors (git-fixes).\n- mac80211: minstrel: fix tx status processing corner case (git-fixes).\n- mac80211: minstrel: remove deferred sampling code (git-fixes).\n- media: imx274: fix frame interval handling (git-fixes).\n- media: platform: Improve queue set up flow for bug fixing (git-fixes).\n- media: tw5864: check status of tw5864_frameinterval_get (git-fixes).\n- media: uvcvideo: Fix dereference of out-of-bound list iterator (git-fixes).\n- media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect (git-fixes).\n- mei: protect mei_cl_mtu from null dereference (git-fixes).\n- memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event (bsc#1177703).\n- mfd: sprd: Add wakeup capability for PMIC IRQ (git-fixes).\n- mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove (git-fixes).\n- mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs (git-fixes).\n- mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers (git-fixes).\n- mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race (MM Functionality, bsc#1178426).\n- mm: fix kthread_use_mm() vs TLB invalidate (MM Functionality, bsc#1178426).\n- mm/gup: allow FOLL_FORCE for get_user_pages_fast() (git fixes (mm/gup)).\n- mm/gup: fix gup_fast with dynamic page table folding (bnc#1176586, LTC#188235).\n- mm/ksm: fix NULL pointer dereference when KSM zero page is enabled (git fixes (mm/ksm)).\n- mm, memcg: fix inconsistent oom event behavior (bsc#1178659).\n- mm/memcg: fix refcount error while moving and swapping (bsc#1178686).\n- mm/memcontrol.c: add missed css_put() (bsc#1178661).\n- mm: mempolicy: require at least one nodeid for MPOL_PREFERRED (git fixes (mm/mempolicy)).\n- mm/swapfile.c: fix potential memory leak in sys_swapon (git-fixes).\n- mm: swap: make page_evictable() inline (git fixes (mm/vmscan)).\n- mm: swap: use smp_mb__after_atomic() to order LRU bit set (git fixes (mm/vmscan)).\n- mm, THP, swap: fix allocating cluster for swapfile by mistake (bsc#1178755).\n- modsign: Add codeSigning EKU when generating X.509 key generation config (bsc#1177353, bsc#1179076).\n- net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send (bsc#1172873).\n- net: ena: Capitalize all log strings and improve code readability (bsc#1177397).\n- net: ena: Change license into format to SPDX in all files (bsc#1177397).\n- net: ena: Change log message to netif/dev function (bsc#1177397).\n- net: ena: Change RSS related macros and variables names (bsc#1177397).\n- net: ena: ethtool: Add new device statistics (bsc#1177397).\n- net: ena: ethtool: add stats printing to XDP queues (bsc#1177397).\n- net: ena: ethtool: convert stat_offset to 64 bit resolution (bsc#1177397).\n- net: ena: Fix all static chekers\u0027 warnings (bsc#1177397).\n- net: ena: fix packet\u0027s addresses for rx_offset feature (bsc#1174852).\n- net: ena: handle bad request id in ena_netdev (bsc#1174852).\n- net: ena: Remove redundant print of placement policy (bsc#1177397).\n- net: ena: xdp: add queue counters for xdp actions (bsc#1177397).\n- net: fix pos incrementment in ipv6_route_seq_next (bsc#1154353).\n- net: introduce helper sendpage_ok() in include/linux/net.h (bsc#1172873). kABI workaround for including mm.h in include/linux/net.h (bsc#1172873).\n- net/mlx5: Clear bw_share upon VF disable (jsc#SLE-8464).\n- net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled (jsc#SLE-8464).\n- net: mscc: ocelot: fix race condition with TX timestamping (bsc#1178461).\n- net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition (git-fixes).\n- nfc: s3fwrn5: use signed integer for parsing GPIO numbers (git-fixes).\n- NFS: only invalidate dentrys that are clearly invalid (bsc#1178669 bsc#1170139).\n- NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE (bsc#1176180).\n- NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE (bsc#1176180).\n- NFSv4.x recover from pre-mature loss of openstateid (bsc#1176180).\n- nvme: do not update disk info for multipathed device (bsc#1171558).\n- nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() (bsc#1172873).\n- p54: avoid accessing the data mapped to streaming DMA (git-fixes).\n- PCI/ACPI: Whitelist hotplug ports for D3 if power managed by ACPI (git-fixes).\n- pinctrl: amd: fix incorrect way to disable debounce filter (git-fixes).\n- pinctrl: amd: use higher precision for 512 RtcClk (git-fixes).\n- pinctrl: aspeed: Fix GPI only function problem (git-fixes).\n- pinctrl: intel: Set default bias in case no particular value given (git-fixes).\n- platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time (git-fixes).\n- platform/x86: toshiba_acpi: Fix the wrong variable assignment (git-fixes).\n- PM: runtime: Drop runtime PM references to supplier on link removal (git-fixes).\n- powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm (MM Functionality, bsc#1178426).\n- powerpc: Inline doorbell sending functions (jsc#SLE-15869 jsc#SLE-16321).\n- powerpc/perf: consolidate GPCI hcall structs into asm/hvcall.h (jsc#SLE-16360 jsc#SLE-16915).\n- powerpc/pmem: Add flush routines using new pmem store and sync instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Add new instructions for persistent storage and sync (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Avoid the barrier in flush routines (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Initialize pmem device on newer hardware (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Restrict papr_scm to P8 and above (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pmem: Update ppc64 to use the new barrier instruction (jsc#SLE-16402 jsc#SLE-16497 bsc#1176109 ltc#187964).\n- powerpc/pseries: Add KVM guest doorbell restrictions (jsc#SLE-15869 jsc#SLE-16321).\n- powerpc/pseries: new lparcfg key/value pair: partition_affinity_score (jsc#SLE-16360 jsc#SLE-16915).\n- powerpc/pseries: Use doorbells even if XIVE is available (jsc#SLE-15869 jsc#SLE-16321).\n- powerpc: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM (MM Functionality, bsc#1178426).\n- powerpc/vnic: Extend \u0027failover pending\u0027 window (bsc#1176855 ltc#187293).\n- power: supply: bq27xxx: report \u0027not charging\u0027 on all types (git-fixes).\n- power: supply: test_power: add missing newlines when printing parameters by sysfs (git-fixes).\n- qla2xxx: Add MODULE_VERSION back to driver (bsc#1179160).\n- RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP (jsc#SLE-8449).\n- RDMA/hns: Fix the wrong value of rnr_retry when querying qp (jsc#SLE-8449).\n- RDMA/hns: Fix wrong field of SRQ number the device supports (jsc#SLE-8449).\n- RDMA/hns: Solve the overflow of the calc_pg_sz() (jsc#SLE-8449).\n- RDMA/mlx5: Fix devlink deadlock on net namespace deletion (jsc#SLE-8464).\n- RDMA/qedr: Fix return code if accept is called on a destroyed qp (jsc#SLE-8215).\n- RDMA/ucma: Add missing locking around rdma_leave_multicast() (git-fixes).\n- reboot: fix overflow parsing reboot cpu number (git-fixes).\n- Refresh patches.suse/vfs-add-super_operations-get_inode_dev. (bsc#1176983) \n- regulator: avoid resolve_supply() infinite recursion (git-fixes).\n- regulator: defer probe when trying to get voltage from unresolved supply (git-fixes).\n- regulator: fix memory leak with repeated set_machine_constraints() (git-fixes).\n- regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} (git-fixes).\n- regulator: ti-abb: Fix array out of bound read access on the first transition (git-fixes).\n- regulator: workaround self-referent regulators (git-fixes).\n- Restore the header of series.conf The header of series.conf was accidentally changed by abb50be8e6bc \u0027(kABI: revert use_mm name change (MM Functionality, bsc#1178426))\u0027. \n- Revert \u0027cdc-acm: hardening against malicious devices\u0027 (git-fixes).\n- Revert \u0027kernel/reboot.c: convert simple_strtoul to kstrtoint\u0027 (git-fixes).\n- Revert \u0027xfs: complain if anyone tries to create a too-large buffer\u0027 (bsc#1179425, bsc#1179550).\n- rfkill: Fix use-after-free in rfkill_resume() (git-fixes).\n- ring-buffer: Fix recursion protection transitions between interrupt context (git-fixes).\n- rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014) Author: Dominique Leuenberger -\u003cdimstar@opensuse.org\u003e\n- rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014) %split_extra still contained two.\n- rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045) egrep is only a deprecated bash wrapper for \u0027grep -E\u0027. So use the latter instead.\n- rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401)\n- rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).\n- rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one). There is: ExportFilter: ^kernel-obs-build.*\\.x86_64.rpm$ . i586 in Factory\u0027s prjconf now. No other actively maintained distro (i.e. merging packaging branch) builds a x86_32 kernel, hence pushing to packaging directly.\n- s390/bpf: Fix multiple tail calls (git-fixes).\n- s390/cpum_cf,perf: change DFLT_CCERROR counter name (bsc#1175918 LTC#187935).\n- s390/cpum_sf.c: fix file permission for cpum_sfb_size (git-fixes).\n- s390/dasd: fix null pointer dereference for ERP requests (git-fixes).\n- s390/pkey: fix paes selftest failure with paes and pkey static build (git-fixes).\n- s390/zcrypt: fix kmalloc 256k failure (bsc#1177066 LTC#188341).\n- s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl (bsc#1177070 LTC#188342).\n- sched/fair: Ensure tasks spreading in LLC during LB (git fixes (sched)).\n- sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list (git fixes (sched)).\n- sched: Fix loadavg accounting race on arm64 kabi (bnc#1178227).\n- sched: Fix rq-\u003enr_iowait ordering (git fixes (sched)).\n- scripts/lib/SUSE/MyBS.pm: properly close prjconf Macros: section\n- scsi: libiscsi: Fix NOP race condition (bsc#1176481).\n- scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() (bsc#1172873).\n- serial: 8250_mtk: Fix uart_get_baud_rate warning (git-fixes).\n- serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init (git-fixes).\n- spi: lpspi: Fix use-after-free on unbind (git-fixes).\n- staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice (git-fixes).\n- staging: octeon: Drop on uncorrectable alignment or FCS error (git-fixes).\n- staging: octeon: repair \u0027fixed-link\u0027 support (git-fixes).\n- staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids (git-fixes).\n- SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (bsc#1154353).\n- SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow() (git-fixes).\n- svcrdma: fix bounce buffers for unaligned offsets and multiple pages (git-fixes).\n- tcp: use sendpage_ok() to detect misused .sendpage (bsc#1172873).\n- thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() (git-fixes).\n- thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() (git-fixes).\n- timer: Fix wheel index calculation on last level (git-fixes).\n- timer: Prevent base-\u003eclk from moving backward (git-fixes).\n- tpm: efi: Do not create binary_bios_measurements file for an empty log (git-fixes).\n- tpm_tis: Disable interrupts on ThinkPad T490s (git-fixes).\n- tracing: Fix out of bounds write in get_trace_buf (git-fixes).\n- tty: serial: fsl_lpuart: add LS1028A support (git-fixes).\n- tty: serial: fsl_lpuart: LS1021A had a FIFO size of 16 words, like LS1028A (git-fixes).\n- tty: serial: imx: fix potential deadlock (git-fixes).\n- tty: serial: imx: keep console clocks always on (git-fixes).\n- uio: Fix use-after-free in uio_unregister_device() (git-fixes).\n- uio: free uio id after uio file node is freed (git-fixes).\n- USB: Add NO_LPM quirk for Kingston flash drive (git-fixes).\n- USB: adutux: fix debugging (git-fixes).\n- USB: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode (git-fixes).\n- USB: cdc-acm: fix cooldown mechanism (git-fixes).\n- USB: core: Change %pK for __user pointers to %px (git-fixes).\n- USB: core: driver: fix stray tabs in error messages (git-fixes).\n- USB: core: Fix regression in Hercules audio card (git-fixes).\n- USB: gadget: Fix memleak in gadgetfs_fill_super (git-fixes).\n- USB: gadget: f_midi: Fix memleak in f_midi_alloc (git-fixes).\n- USB: gadget: goku_udc: fix potential crashes in probe (git-fixes).\n- USB: host: fsl-mph-dr-of: check return of dma_set_mask() (git-fixes).\n- USB: mtu3: fix panic in mtu3_gadget_stop() (git-fixes).\n- USB: serial: cyberjack: fix write-URB completion race (git-fixes).\n- USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 (git-fixes).\n- USB: serial: option: add Quectel EC200T module support (git-fixes).\n- USB: serial: option: add Telit FN980 composition 0x1055 (git-fixes).\n- USB: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart (git-fixes).\n- USB: typec: tcpm: reset hard_reset_count for any disconnect (git-fixes).\n- USB: xhci: omit duplicate actions when suspending a runtime suspended host (git-fixes).\n- video: hyperv_fb: Fix the cache type when mapping the VRAM (git-fixes).\n- video: hyperv_fb: include vmalloc.h (git-fixes).\n- video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host (bsc#1175306).\n- video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (bsc#1175306).\n- video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs (bsc#1175306).\n- virtio: virtio_console: fix DMA memory allocation for rproc serial (git-fixes).\n- vt: Disable KD_FONT_OP_COPY (bsc#1178589).\n- x86/hyperv: Clarify comment on x2apic mode (git-fixes).\n- x86/i8259: Use printk_deferred() to prevent deadlock (git-fixes).\n- x86/kexec: Use up-to-dated screen_info copy to fill boot params (bsc#1175306).\n- x86/microcode/intel: Check patch signature before saving microcode for early loading (bsc#1152489).\n- x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP (bsc#1152489).\n- xfs: complain if anyone tries to create a too-large buffer log item (bsc#1166146).\n- xfs: do not update mtime on COW faults (bsc#1167030).\n- xfs: fix a missing unlock on error in xfs_fs_map_blocks (git-fixes).\n- xfs: fix brainos in the refcount scrubber\u0027s rmap fragment processor (git-fixes).\n- xfs: fix flags argument to rmap lookup when converting shared file rmaps (git-fixes).\n- xfs: fix rmap key and record comparison functions (git-fixes).\n- xfs: fix scrub flagging rtinherit even if there is no rt device (git-fixes).\n- xfs: flush new eof page on truncate to avoid post-eof corruption (git-fixes).\n- xfs: introduce XFS_MAX_FILEOFF (bsc#1166166).\n- xfs: prohibit fs freezing when using empty transactions (bsc#1179442).\n- xfs: remove unused variable \u0027done\u0027 (bsc#1166166).\n- xfs: revert \u0027xfs: fix rmap key and record comparison functions\u0027 (git-fixes).\n- xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents (git-fixes).\n- xfs: set xefi_discard when creating a deferred agfl free log intent item (git-fixes).\n- xfs: truncate should remove all blocks, not just to the end of the page cache (bsc#1166166).\n- xhci: Fix sizeof() mismatch (git-fixes).\n- xhci: hisilicon: fix refercence leak in xhci_histb_probe (git-fixes).\n\nkernel-default-base fixes the following issues:\n\n- Add wireguard kernel module (bsc#1179225)\n- Create the list of crypto kernel modules dynamically, supersedes hardcoded list of crc32 implementations (bsc#1177577)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-2260",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_2260-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:2260-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZYES3O2NEKKQXQ3R5CZOH5YCWJ3TJSKH/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:2260-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZYES3O2NEKKQXQ3R5CZOH5YCWJ3TJSKH/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1149032",
        "url": "https://bugzilla.suse.com/1149032"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1152489",
        "url": "https://bugzilla.suse.com/1152489"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1153274",
        "url": "https://bugzilla.suse.com/1153274"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1154353",
        "url": "https://bugzilla.suse.com/1154353"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1155518",
        "url": "https://bugzilla.suse.com/1155518"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1160634",
        "url": "https://bugzilla.suse.com/1160634"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1166146",
        "url": "https://bugzilla.suse.com/1166146"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1166166",
        "url": "https://bugzilla.suse.com/1166166"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1167030",
        "url": "https://bugzilla.suse.com/1167030"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1167773",
        "url": "https://bugzilla.suse.com/1167773"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1170139",
        "url": "https://bugzilla.suse.com/1170139"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1171073",
        "url": "https://bugzilla.suse.com/1171073"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1171558",
        "url": "https://bugzilla.suse.com/1171558"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172873",
        "url": "https://bugzilla.suse.com/1172873"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1173504",
        "url": "https://bugzilla.suse.com/1173504"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1174852",
        "url": "https://bugzilla.suse.com/1174852"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1175306",
        "url": "https://bugzilla.suse.com/1175306"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1175918",
        "url": "https://bugzilla.suse.com/1175918"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176109",
        "url": "https://bugzilla.suse.com/1176109"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176180",
        "url": "https://bugzilla.suse.com/1176180"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176200",
        "url": "https://bugzilla.suse.com/1176200"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176481",
        "url": "https://bugzilla.suse.com/1176481"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176586",
        "url": "https://bugzilla.suse.com/1176586"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176855",
        "url": "https://bugzilla.suse.com/1176855"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176983",
        "url": "https://bugzilla.suse.com/1176983"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177066",
        "url": "https://bugzilla.suse.com/1177066"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177070",
        "url": "https://bugzilla.suse.com/1177070"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177353",
        "url": "https://bugzilla.suse.com/1177353"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177397",
        "url": "https://bugzilla.suse.com/1177397"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177577",
        "url": "https://bugzilla.suse.com/1177577"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177666",
        "url": "https://bugzilla.suse.com/1177666"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177703",
        "url": "https://bugzilla.suse.com/1177703"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177820",
        "url": "https://bugzilla.suse.com/1177820"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178123",
        "url": "https://bugzilla.suse.com/1178123"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178182",
        "url": "https://bugzilla.suse.com/1178182"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178227",
        "url": "https://bugzilla.suse.com/1178227"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178286",
        "url": "https://bugzilla.suse.com/1178286"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178304",
        "url": "https://bugzilla.suse.com/1178304"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178330",
        "url": "https://bugzilla.suse.com/1178330"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178393",
        "url": "https://bugzilla.suse.com/1178393"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178401",
        "url": "https://bugzilla.suse.com/1178401"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178426",
        "url": "https://bugzilla.suse.com/1178426"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178461",
        "url": "https://bugzilla.suse.com/1178461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178579",
        "url": "https://bugzilla.suse.com/1178579"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178581",
        "url": "https://bugzilla.suse.com/1178581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178584",
        "url": "https://bugzilla.suse.com/1178584"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178585",
        "url": "https://bugzilla.suse.com/1178585"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178589",
        "url": "https://bugzilla.suse.com/1178589"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178635",
        "url": "https://bugzilla.suse.com/1178635"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178653",
        "url": "https://bugzilla.suse.com/1178653"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178659",
        "url": "https://bugzilla.suse.com/1178659"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178661",
        "url": "https://bugzilla.suse.com/1178661"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178669",
        "url": "https://bugzilla.suse.com/1178669"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178686",
        "url": "https://bugzilla.suse.com/1178686"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178740",
        "url": "https://bugzilla.suse.com/1178740"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178755",
        "url": "https://bugzilla.suse.com/1178755"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178762",
        "url": "https://bugzilla.suse.com/1178762"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178838",
        "url": "https://bugzilla.suse.com/1178838"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178853",
        "url": "https://bugzilla.suse.com/1178853"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178886",
        "url": "https://bugzilla.suse.com/1178886"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179001",
        "url": "https://bugzilla.suse.com/1179001"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179012",
        "url": "https://bugzilla.suse.com/1179012"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179014",
        "url": "https://bugzilla.suse.com/1179014"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179015",
        "url": "https://bugzilla.suse.com/1179015"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179045",
        "url": "https://bugzilla.suse.com/1179045"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179076",
        "url": "https://bugzilla.suse.com/1179076"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179082",
        "url": "https://bugzilla.suse.com/1179082"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179107",
        "url": "https://bugzilla.suse.com/1179107"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179140",
        "url": "https://bugzilla.suse.com/1179140"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179141",
        "url": "https://bugzilla.suse.com/1179141"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179160",
        "url": "https://bugzilla.suse.com/1179160"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179201",
        "url": "https://bugzilla.suse.com/1179201"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179211",
        "url": "https://bugzilla.suse.com/1179211"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179217",
        "url": "https://bugzilla.suse.com/1179217"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179225",
        "url": "https://bugzilla.suse.com/1179225"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179419",
        "url": "https://bugzilla.suse.com/1179419"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179424",
        "url": "https://bugzilla.suse.com/1179424"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179425",
        "url": "https://bugzilla.suse.com/1179425"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179426",
        "url": "https://bugzilla.suse.com/1179426"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179427",
        "url": "https://bugzilla.suse.com/1179427"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179429",
        "url": "https://bugzilla.suse.com/1179429"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179432",
        "url": "https://bugzilla.suse.com/1179432"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179442",
        "url": "https://bugzilla.suse.com/1179442"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179550",
        "url": "https://bugzilla.suse.com/1179550"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15436 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15436/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15437 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15437/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25668 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25668/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25669 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25669/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25704 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25704/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27777 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27777/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28915 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28915/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28941 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28941/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28974 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28974/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-29369 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-29369/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-29371 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-29371/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-4788 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-4788/"
      }
    ],
    "title": "Security update for the Linux Kernel",
    "tracking": {
      "current_release_date": "2020-12-15T09:29:17Z",
      "generator": {
        "date": "2020-12-15T09:29:17Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:2260-1",
      "initial_release_date": "2020-12-15T09:29:17Z",
      "revision_history": [
        {
          "date": "2020-12-15T09:29:17Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
                "product": {
                  "name": "kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
                  "product_id": "kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
                "product": {
                  "name": "kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
                  "product_id": "kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        },
        "product_reference": "kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        },
        "product_reference": "kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15436",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15436"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15436",
          "url": "https://www.suse.com/security/cve/CVE-2020-15436"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179141 for CVE-2020-15436",
          "url": "https://bugzilla.suse.com/1179141"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15436"
    },
    {
      "cve": "CVE-2020-15437",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15437"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p-\u003eserial_in pointer which uninitialized.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15437",
          "url": "https://www.suse.com/security/cve/CVE-2020-15437"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179140 for CVE-2020-15437",
          "url": "https://bugzilla.suse.com/1179140"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15437"
    },
    {
      "cve": "CVE-2020-25668",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25668"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25668",
          "url": "https://www.suse.com/security/cve/CVE-2020-25668"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178123 for CVE-2020-25668",
          "url": "https://bugzilla.suse.com/1178123"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178622 for CVE-2020-25668",
          "url": "https://bugzilla.suse.com/1178622"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1196914 for CVE-2020-25668",
          "url": "https://bugzilla.suse.com/1196914"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25668"
    },
    {
      "cve": "CVE-2020-25669",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25669"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25669",
          "url": "https://www.suse.com/security/cve/CVE-2020-25669"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178182 for CVE-2020-25669",
          "url": "https://bugzilla.suse.com/1178182"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25669"
    },
    {
      "cve": "CVE-2020-25704",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25704"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25704",
          "url": "https://www.suse.com/security/cve/CVE-2020-25704"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178393 for CVE-2020-25704",
          "url": "https://bugzilla.suse.com/1178393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25704"
    },
    {
      "cve": "CVE-2020-27777",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27777"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27777",
          "url": "https://www.suse.com/security/cve/CVE-2020-27777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179107 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1179107"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179419 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1179419"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200343 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1200343"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1220060 for CVE-2020-27777",
          "url": "https://bugzilla.suse.com/1220060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27777"
    },
    {
      "cve": "CVE-2020-28915",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28915"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28915",
          "url": "https://www.suse.com/security/cve/CVE-2020-28915"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178886 for CVE-2020-28915",
          "url": "https://bugzilla.suse.com/1178886"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-28915"
    },
    {
      "cve": "CVE-2020-28941",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28941"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28941",
          "url": "https://www.suse.com/security/cve/CVE-2020-28941"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178740 for CVE-2020-28941",
          "url": "https://bugzilla.suse.com/1178740"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-28941"
    },
    {
      "cve": "CVE-2020-28974",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28974"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28974",
          "url": "https://www.suse.com/security/cve/CVE-2020-28974"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178589 for CVE-2020-28974",
          "url": "https://bugzilla.suse.com/1178589"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-28974"
    },
    {
      "cve": "CVE-2020-29369",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-29369"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-29369",
          "url": "https://www.suse.com/security/cve/CVE-2020-29369"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173504 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1173504"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179432 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1179432"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179646 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1179646"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182109 for CVE-2020-29369",
          "url": "https://bugzilla.suse.com/1182109"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-29369"
    },
    {
      "cve": "CVE-2020-29371",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-29371"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-29371",
          "url": "https://www.suse.com/security/cve/CVE-2020-29371"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179429 for CVE-2020-29371",
          "url": "https://bugzilla.suse.com/1179429"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-29371"
    },
    {
      "cve": "CVE-2020-4788",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-4788"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
          "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-4788",
          "url": "https://www.suse.com/security/cve/CVE-2020-4788"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177666 for CVE-2020-4788",
          "url": "https://bugzilla.suse.com/1177666"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181158 for CVE-2020-4788",
          "url": "https://bugzilla.suse.com/1181158"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:kernel-default-base-5.3.18-lp152.57.1.lp152.8.17.1.x86_64",
            "openSUSE Leap 15.2:kernel-default-base-rebuild-5.3.18-lp152.57.1.lp152.8.17.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-15T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-4788"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2020-15436 (GCVE-0-2020-15436)

Solution

Tags

Sightings

Nomenclature