{"id":"CVE-2016-4580","aliases":["DEBIAN-CVE-2016-4580","DLA-516-1","DSA-3607-1","EUVD-2016-5566","GHSA-wj4h-397w-w967","SUSE-SU-2016:1672-1","SUSE-SU-2016:1985-1","SUSE-SU-2016:2245-1","SUSE-SU-2017:0333-1","UBUNTU-CVE-2016-4580","USN-3016-1","USN-3016-2","USN-3016-3","USN-3016-4","USN-3017-3","USN-3018-1","USN-3019-1","USN-3020-1"],"status":"published","title":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5...","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04065,"percentile":0.90738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-05-23T00:00:00Z","modified":"2026-09-22T07:00:24Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.5.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.5.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.5.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-91.138"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-76.98~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-64.72~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","fixed_in":["4.2.0-41.48~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-28.47~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-28.47"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1016.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1019.22"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.81-1"}]}],"versions":["3.2.41-2","3.2.41-2+deb7u1","3.2.41-2+deb7u2","3.2.41-2+deb7u2~bpo60+1","3.2.46-1","3.2.46-1+deb7u1","3.2.46-1+deb7u1~bpo60+1","3.2.46-1~bpo60+1","3.2.51-1","3.2.51-1~bpo60+1","3.2.53-1","3.2.53-2","3.2.54-1","3.2.54-2","3.2.54-2~bpo60+1","3.2.57-1","3.2.57-2","3.2.57-3","3.2.57-3+deb7u1","3.2.57-3+deb7u2","3.2.57-3+deb7u2~bpo60+1","3.2.60-1","3.2.60-1+deb7u1","3.2.60-1+deb7u2","3.2.60-1+deb7u3","3.2.60-1+deb7u3~bpo60+1","3.2.63-1","3.2.63-2","3.2.63-2+deb7u1","3.2.63-2+deb7u1~bpo60+1","3.2.63-2+deb7u2","3.2.63-2+deb7u2~bpo60+1","3.2.65-1","3.2.65-1+deb7u1","3.2.65-1+deb7u1~bpo60+1","3.2.65-1+deb7u2","3.2.65-1+deb7u2~bpo60+1","3.2.68-1","3.2.68-1+deb7u1","3.2.68-1+deb7u1~bpo60+1","3.2.68-1+deb7u2","3.2.68-1+deb7u2~bpo60+1","3.2.68-1+deb7u3","3.2.68-1+deb7u3~bpo60+1","3.2.68-1+deb7u4","3.2.68-1+deb7u4~bpo60+1","3.2.68-1+deb7u5","3.2.68-1+deb7u6","3.2.68-1+deb7u6~bpo60+1","3.2.71-1","3.2.71-2","3.2.73-1","3.2.73-2","3.2.73-2+deb7u1","3.2.73-2+deb7u2","3.2.73-2+deb7u2~bpo60+1","3.2.73-2+deb7u3","3.2.78-1"],"bundled":27},{"source":"osv","ecosystem":"Debian:8","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt25-2+deb8u2"}]}],"versions":["3.16.7-ckt11-1","3.16.7-ckt11-1+deb8u1","3.16.7-ckt11-1+deb8u2","3.16.7-ckt11-1+deb8u2~bpo70+1","3.16.7-ckt11-1+deb8u3","3.16.7-ckt11-1+deb8u3~bpo70+1","3.16.7-ckt11-1+deb8u4","3.16.7-ckt11-1+deb8u4~bpo70+1","3.16.7-ckt11-1+deb8u5","3.16.7-ckt11-1+deb8u6","3.16.7-ckt11-1+deb8u6~bpo70+1","3.16.7-ckt11-1~bpo70+1","3.16.7-ckt17-1","3.16.7-ckt20-1","3.16.7-ckt20-1+deb8u1","3.16.7-ckt20-1+deb8u2","3.16.7-ckt20-1+deb8u2~bpo70+1","3.16.7-ckt20-1+deb8u3","3.16.7-ckt20-1+deb8u3~bpo70+1","3.16.7-ckt20-1+deb8u4","3.16.7-ckt20-1+deb8u4~bpo70+1","3.16.7-ckt25-1","3.16.7-ckt25-1~bpo70+1","3.16.7-ckt25-2","3.16.7-ckt25-2+deb8u1","3.16.7-ckt25-2~bpo70+1","3.16.7-ckt9-2","3.16.7-ckt9-3","3.16.7-ckt9-3~deb8u1","3.16.7-ckt9-3~deb8u1~bpo70+1"],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.2"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-77.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-57.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-rt_trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-57.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-57.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-57.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"kernel-bigsmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"kernel-bigsmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"kernel-bigsmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-bigsmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.86.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.7.53.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.7.53.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.7.53.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.7.53.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.7.53.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.7.53.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.7.53.1"}]}],"bundled":45},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-91.138"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-76.98~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1","3.16.0-44.59~14.04.1","3.16.0-45.60~14.04.1","3.16.0-46.62~14.04.1","3.16.0-48.64~14.04.1","3.16.0-49.65~14.04.1","3.16.0-50.66~14.04.1","3.16.0-50.67~14.04.1","3.16.0-51.69~14.04.1","3.16.0-52.71~14.04.1","3.16.0-53.72~14.04.1","3.16.0-55.74~14.04.1","3.16.0-56.75~14.04.1","3.16.0-57.77~14.04.1","3.16.0-59.79~14.04.1","3.16.0-60.80~14.04.1","3.16.0-62.82~14.04.1","3.16.0-62.83~14.04.1","3.16.0-67.87~14.04.1","3.16.0-69.89~14.04.1","3.16.0-70.90~14.04.1","3.16.0-71.91~14.04.1","3.16.0-71.92~14.04.1","3.16.0-73.95~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-64.72~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1","3.19.0-51.57~14.04.1","3.19.0-51.58~14.04.1","3.19.0-56.62~14.04.1","3.19.0-58.64~14.04.1","3.19.0-59.65~14.04.1","3.19.0-59.66~14.04.1","3.19.0-61.69~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-41.48~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1","4.2.0-27.32~14.04.1","4.2.0-30.35~14.04.1","4.2.0-30.36~14.04.1","4.2.0-34.39~14.04.1","4.2.0-35.40~14.04.1","4.2.0-36.41~14.04.1","4.2.0-36.42~14.04.1","4.2.0-38.45~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-28.47~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-28.47"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1016.22"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1019.22"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-28.47"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1016.22"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1019.22"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-28.47~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-41.48~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1","4.2.0-27.32~14.04.1","4.2.0-30.35~14.04.1","4.2.0-30.36~14.04.1","4.2.0-34.39~14.04.1","4.2.0-35.40~14.04.1","4.2.0-36.41~14.04.1","4.2.0-36.42~14.04.1","4.2.0-38.45~14.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-91.138"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-76.98~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1","3.16.0-44.59~14.04.1","3.16.0-45.60~14.04.1","3.16.0-46.62~14.04.1","3.16.0-48.64~14.04.1","3.16.0-49.65~14.04.1","3.16.0-50.66~14.04.1","3.16.0-50.67~14.04.1","3.16.0-51.69~14.04.1","3.16.0-52.71~14.04.1","3.16.0-53.72~14.04.1","3.16.0-55.74~14.04.1","3.16.0-56.75~14.04.1","3.16.0-57.77~14.04.1","3.16.0-59.79~14.04.1","3.16.0-60.80~14.04.1","3.16.0-62.82~14.04.1","3.16.0-62.83~14.04.1","3.16.0-67.87~14.04.1","3.16.0-69.89~14.04.1","3.16.0-70.90~14.04.1","3.16.0-71.91~14.04.1","3.16.0-71.92~14.04.1","3.16.0-73.95~14.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-64.72~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1","3.19.0-51.57~14.04.1","3.19.0-51.58~14.04.1","3.19.0-56.62~14.04.1","3.19.0-58.64~14.04.1","3.19.0-59.65~14.04.1","3.19.0-59.66~14.04.1","3.19.0-61.69~14.04.1"],"bundled":8}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/05/10/12","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://github.com/torvalds/linux/commit/79e48650320e6fba48369fccf13fd045315b19b8","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3017-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3017-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3018-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3021-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3017-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3019-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=79e48650320e6fba48369fccf13fd045315b19b8","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3607","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3016-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3016-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3021-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3018-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.5","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://www.securityfocus.com/bid/90528","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3016-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3016-4","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3020-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4580"},{"url":"https://github.com/advisories/GHSA-wj4h-397w-w967"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4580","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161672-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/676471","tags":["report"]},{"url":"https://bugzilla.suse.com/866130","tags":["report"]},{"url":"https://bugzilla.suse.com/898592","tags":["report"]},{"url":"https://bugzilla.suse.com/936530","tags":["report"]},{"url":"https://bugzilla.suse.com/940413","tags":["report"]},{"url":"https://bugzilla.suse.com/944309","tags":["report"]},{"url":"https://bugzilla.suse.com/946122","tags":["report"]},{"url":"https://bugzilla.suse.com/949752","tags":["report"]},{"url":"https://bugzilla.suse.com/953369","tags":["report"]},{"url":"https://bugzilla.suse.com/956491","tags":["report"]},{"url":"https://bugzilla.suse.com/956852","tags":["report"]},{"url":"https://bugzilla.suse.com/957986","tags":["report"]},{"url":"https://bugzilla.suse.com/957988","tags":["report"]},{"url":"https://bugzilla.suse.com/957990","tags":["report"]},{"url":"https://bugzilla.suse.com/959381","tags":["report"]},{"url":"https://bugzilla.suse.com/960458","tags":["report"]},{"url":"https://bugzilla.suse.com/960857","tags":["report"]},{"url":"https://bugzilla.suse.com/961512","tags":["report"]},{"url":"https://bugzilla.suse.com/961518","tags":["report"]},{"url":"https://bugzilla.suse.com/963762","tags":["report"]},{"url":"https://bugzilla.suse.com/963998","tags":["report"]},{"url":"https://bugzilla.suse.com/965319","tags":["report"]},{"url":"https://bugzilla.suse.com/965860","tags":["report"]},{"url":"https://bugzilla.suse.com/965923","tags":["report"]},{"url":"https://bugzilla.suse.com/966245","tags":["report"]},{"url":"https://bugzilla.suse.com/967863","tags":["report"]},{"url":"https://bugzilla.suse.com/967914","tags":["report"]},{"url":"https://bugzilla.suse.com/968010","tags":["report"]},{"url":"https://bugzilla.suse.com/968018","tags":["report"]},{"url":"https://bugzilla.suse.com/968141","tags":["report"]},{"url":"https://bugzilla.suse.com/968500","tags":["report"]},{"url":"https://bugzilla.suse.com/968566","tags":["report"]},{"url":"https://bugzilla.suse.com/968670","tags":["report"]},{"url":"https://bugzilla.suse.com/968687","tags":["report"]},{"url":"https://bugzilla.suse.com/969149","tags":["report"]},{"url":"https://bugzilla.suse.com/969391","tags":["report"]},{"url":"https://bugzilla.suse.com/969571","tags":["report"]},{"url":"https://bugzilla.suse.com/970114","tags":["report"]},{"url":"https://bugzilla.suse.com/970504","tags":["report"]},{"url":"https://bugzilla.suse.com/970892","tags":["report"]},{"url":"https://bugzilla.suse.com/970909","tags":["report"]},{"url":"https://bugzilla.suse.com/970911","tags":["report"]},{"url":"https://bugzilla.suse.com/970948","tags":["report"]},{"url":"https://bugzilla.suse.com/970956","tags":["report"]},{"url":"https://bugzilla.suse.com/970958","tags":["report"]},{"url":"https://bugzilla.suse.com/970970","tags":["report"]},{"url":"https://bugzilla.suse.com/971124","tags":["report"]},{"url":"https://bugzilla.suse.com/971125","tags":["report"]},{"url":"https://bugzilla.suse.com/971126","tags":["report"]},{"url":"https://bugzilla.suse.com/971360","tags":["report"]},{"url":"https://bugzilla.suse.com/971433","tags":["report"]},{"url":"https://bugzilla.suse.com/971446","tags":["report"]},{"url":"https://bugzilla.suse.com/971729","tags":["report"]},{"url":"https://bugzilla.suse.com/971944","tags":["report"]},{"url":"https://bugzilla.suse.com/971947","tags":["report"]},{"url":"https://bugzilla.suse.com/971989","tags":["report"]},{"url":"https://bugzilla.suse.com/972363","tags":["report"]},{"url":"https://bugzilla.suse.com/973237","tags":["report"]},{"url":"https://bugzilla.suse.com/973378","tags":["report"]},{"url":"https://bugzilla.suse.com/973556","tags":["report"]},{"url":"https://bugzilla.suse.com/973570","tags":["report"]},{"url":"https://bugzilla.suse.com/974646","tags":["report"]},{"url":"https://bugzilla.suse.com/974787","tags":["report"]},{"url":"https://bugzilla.suse.com/975358","tags":["report"]},{"url":"https://bugzilla.suse.com/975772","tags":["report"]},{"url":"https://bugzilla.suse.com/975945","tags":["report"]},{"url":"https://bugzilla.suse.com/976739","tags":["report"]},{"url":"https://bugzilla.suse.com/976868","tags":["report"]},{"url":"https://bugzilla.suse.com/978401","tags":["report"]},{"url":"https://bugzilla.suse.com/978821","tags":["report"]},{"url":"https://bugzilla.suse.com/978822","tags":["report"]},{"url":"https://bugzilla.suse.com/979213","tags":["report"]},{"url":"https://bugzilla.suse.com/979274","tags":["report"]},{"url":"https://bugzilla.suse.com/979347","tags":["report"]},{"url":"https://bugzilla.suse.com/979419","tags":["report"]},{"url":"https://bugzilla.suse.com/979548","tags":["report"]},{"url":"https://bugzilla.suse.com/979595","tags":["report"]},{"url":"https://bugzilla.suse.com/979867","tags":["report"]},{"url":"https://bugzilla.suse.com/979879","tags":["report"]},{"url":"https://bugzilla.suse.com/980371","tags":["report"]},{"url":"https://bugzilla.suse.com/980725","tags":["report"]},{"url":"https://bugzilla.suse.com/980788","tags":["report"]},{"url":"https://bugzilla.suse.com/980931","tags":["report"]},{"url":"https://bugzilla.suse.com/981231","tags":["report"]},{"url":"https://bugzilla.suse.com/981267","tags":["report"]},{"url":"https://bugzilla.suse.com/982532","tags":["report"]},{"url":"https://bugzilla.suse.com/982691","tags":["report"]},{"url":"https://bugzilla.suse.com/983143","tags":["report"]},{"url":"https://bugzilla.suse.com/983213","tags":["report"]},{"url":"https://bugzilla.suse.com/984107","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5244","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161985-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/909589","tags":["report"]},{"url":"https://bugzilla.suse.com/950998","tags":["report"]},{"url":"https://bugzilla.suse.com/954847","tags":["report"]},{"url":"https://bugzilla.suse.com/971030","tags":["report"]},{"url":"https://bugzilla.suse.com/974620","tags":["report"]},{"url":"https://bugzilla.suse.com/979915","tags":["report"]},{"url":"https://bugzilla.suse.com/980246","tags":["report"]},{"url":"https://bugzilla.suse.com/982544","tags":["report"]},{"url":"https://bugzilla.suse.com/983721","tags":["report"]},{"url":"https://bugzilla.suse.com/984755","tags":["report"]},{"url":"https://bugzilla.suse.com/986362","tags":["report"]},{"url":"https://bugzilla.suse.com/986572","tags":["report"]},{"url":"https://bugzilla.suse.com/988498","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5829","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162245-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/839104","tags":["report"]},{"url":"https://bugzilla.suse.com/919351","tags":["report"]},{"url":"https://bugzilla.suse.com/960689","tags":["report"]},{"url":"https://bugzilla.suse.com/962404","tags":["report"]},{"url":"https://bugzilla.suse.com/963655","tags":["report"]},{"url":"https://bugzilla.suse.com/966460","tags":["report"]},{"url":"https://bugzilla.suse.com/974428","tags":["report"]},{"url":"https://bugzilla.suse.com/979681","tags":["report"]},{"url":"https://bugzilla.suse.com/983535","tags":["report"]},{"url":"https://bugzilla.suse.com/986365","tags":["report"]},{"url":"https://bugzilla.suse.com/986445","tags":["report"]},{"url":"https://bugzilla.suse.com/987709","tags":["report"]},{"url":"https://bugzilla.suse.com/988065","tags":["report"]},{"url":"https://bugzilla.suse.com/989152","tags":["report"]},{"url":"https://bugzilla.suse.com/989401","tags":["report"]},{"url":"https://bugzilla.suse.com/991608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6480","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170333-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1003077","tags":["report"]},{"url":"https://bugzilla.suse.com/1003925","tags":["report"]},{"url":"https://bugzilla.suse.com/1004517","tags":["report"]},{"url":"https://bugzilla.suse.com/1007944","tags":["report"]},{"url":"https://bugzilla.suse.com/1008645","tags":["report"]},{"url":"https://bugzilla.suse.com/1008831","tags":["report"]},{"url":"https://bugzilla.suse.com/1008833","tags":["report"]},{"url":"https://bugzilla.suse.com/1009443","tags":["report"]},{"url":"https://bugzilla.suse.com/1010150","tags":["report"]},{"url":"https://bugzilla.suse.com/1010467","tags":["report"]},{"url":"https://bugzilla.suse.com/1010501","tags":["report"]},{"url":"https://bugzilla.suse.com/1010507","tags":["report"]},{"url":"https://bugzilla.suse.com/1010711","tags":["report"]},{"url":"https://bugzilla.suse.com/1010716","tags":["report"]},{"url":"https://bugzilla.suse.com/1011482","tags":["report"]},{"url":"https://bugzilla.suse.com/1011685","tags":["report"]},{"url":"https://bugzilla.suse.com/1012422","tags":["report"]},{"url":"https://bugzilla.suse.com/1012832","tags":["report"]},{"url":"https://bugzilla.suse.com/1013038","tags":["report"]},{"url":"https://bugzilla.suse.com/1013531","tags":["report"]},{"url":"https://bugzilla.suse.com/1013542","tags":["report"]},{"url":"https://bugzilla.suse.com/1014746","tags":["report"]},{"url":"https://bugzilla.suse.com/1017710","tags":["report"]},{"url":"https://bugzilla.suse.com/1021258","tags":["report"]},{"url":"https://bugzilla.suse.com/835175","tags":["report"]},{"url":"https://bugzilla.suse.com/863873","tags":["report"]},{"url":"https://bugzilla.suse.com/874145","tags":["report"]},{"url":"https://bugzilla.suse.com/896484","tags":["report"]},{"url":"https://bugzilla.suse.com/908069","tags":["report"]},{"url":"https://bugzilla.suse.com/914939","tags":["report"]},{"url":"https://bugzilla.suse.com/922947","tags":["report"]},{"url":"https://bugzilla.suse.com/927287","tags":["report"]},{"url":"https://bugzilla.suse.com/940966","tags":["report"]},{"url":"https://bugzilla.suse.com/954984","tags":["report"]},{"url":"https://bugzilla.suse.com/956514","tags":["report"]},{"url":"https://bugzilla.suse.com/958000","tags":["report"]},{"url":"https://bugzilla.suse.com/963053","tags":["report"]},{"url":"https://bugzilla.suse.com/967716","tags":["report"]},{"url":"https://bugzilla.suse.com/969340","tags":["report"]},{"url":"https://bugzilla.suse.com/980363","tags":["report"]},{"url":"https://bugzilla.suse.com/989261","tags":["report"]},{"url":"https://bugzilla.suse.com/991665","tags":["report"]},{"url":"https://bugzilla.suse.com/992566","tags":["report"]},{"url":"https://bugzilla.suse.com/993890","tags":["report"]},{"url":"https://bugzilla.suse.com/993891","tags":["report"]},{"url":"https://bugzilla.suse.com/994296","tags":["report"]},{"url":"https://bugzilla.suse.com/994436","tags":["report"]},{"url":"https://bugzilla.suse.com/994618","tags":["report"]},{"url":"https://bugzilla.suse.com/994759","tags":["report"]},{"url":"https://bugzilla.suse.com/995968","tags":["report"]},{"url":"https://bugzilla.suse.com/997059","tags":["report"]},{"url":"https://bugzilla.suse.com/999932","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2004-0230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5551","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4580","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3016-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3016-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3017-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3017-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3016-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3016-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3017-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3020-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3018-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3018-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3019-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3021-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3021-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4565","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4580","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","status":"published","published":"2016-05-23T10:00:00Z","modified":"2024-08-06T00:32:25.837Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5566","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","status":"published","published":"2016-05-23T10:00:00Z","modified":"2024-08-06T00:32:25Z","updated_at":"2026-11-03T02:22:45.901874Z"}],"ghsa":[{"id":"GHSA-wj4h-397w-w967","title":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5...","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","status":"published","published":"2022-05-17T03:41:04Z","modified":"2023-01-27T05:08:02Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:43:14.514072Z"}],"nvd":[{"id":"CVE-2016-4580","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","status":"published","published":"2016-05-23T10:59:10.177Z","modified":"2026-06-17T00:47:49.837Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-4580","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","status":"published","published":"2016-05-23T10:59:10.177Z","modified":"2026-03-15T22:07:55.742348Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4580","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","status":"published","published":"2016-05-23T10:59:10.177Z","modified":"2026-09-22T07:00:24.786533336Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4580","description":"The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.","status":"published","published":"2016-05-23T00:00:00Z","modified":"2026-04-22T10:44:50.53598Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-516-1","title":"linux - security update","status":"published","published":"2016-06-16T00:00:00Z","modified":"2026-03-09T02:09:02.353939Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3607-1","title":"linux - security update","status":"published","published":"2016-06-28T00:00:00Z","modified":"2026-03-09T01:21:44.956801Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"SUSE-SU-2016:1672-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.\n\nNotable changes in this kernel:\n- It is now possible to mount a NFS export on the exporting host directly.\n\nThe following security bugs were fixed:\n- CVE-2016-5244: A kernel information leak in rds_inc_info_copy was fixed that could leak kernel stack memory to userspace (bsc#983213).\n- CVE-2016-1583: Prevent the usage of mmap when the lower file system does not allow it. This could have lead to local privilege escalation when ecryptfs-utils was installed and /sbin/mount.ecryptfs_private was setuid (bsc#983143).\n- CVE-2016-4913: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel mishandles NM (aka alternate name) entries containing \\0 characters, which allowed local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem (bnc#980725).\n- CVE-2016-4580: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel did not properly initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request (bnc#981267).\n- CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions (bnc#980371).\n- CVE-2016-0758: Tags with indefinite length could have corrupted pointers in asn1_find_indefinite_length (bsc#979867).\n- CVE-2016-2187: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971944).\n- CVE-2016-4482: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call (bnc#978401).\n- CVE-2016-2053: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel allowed attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c (bnc#963762).\n- CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relies on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bnc#979548).\n- CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel did not initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory by reading a message (bnc#978821).\n- CVE-2016-4578: sound/core/timer.c in the Linux kernel did not initialize certain r1 data structures, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions (bnc#979879).\n- CVE-2016-4569: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface (bnc#979213).\n- CVE-2016-4486: The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#978822).\n- CVE-2016-3134: The netfilter subsystem in the Linux kernel did not validate certain offset fields, which allowed local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call (bnc#971126).\n- CVE-2016-2847: fs/pipe.c in the Linux kernel did not limit the amount of unread data in pipes, which allowed local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes (bnc#970948).\n- CVE-2016-2188: The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970956).\n- CVE-2016-3138: The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor (bnc#970911).\n- CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions (bnc#970970).\n- CVE-2016-3140: The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970892).\n- CVE-2016-2186: The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970958).\n- CVE-2016-2185: The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971124).\n- CVE-2016-3156: The IPv4 implementation in the Linux kernel mishandles destruction of device objects, which allowed guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses (bnc#971360).\n- CVE-2016-2184: The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971125).\n- CVE-2016-3139: The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970909).\n- CVE-2016-2143: The fork implementation in the Linux kernel on s390 platforms mishandles the case of four page-table levels, which allowed local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h (bnc#970504).\n- CVE-2016-2782: The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint (bnc#968670).\n- CVE-2015-8816: The hub_activate function in drivers/usb/core/hub.c in the Linux kernel did not properly maintain a hub-interface data structure, which allowed physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device (bnc#968010).\n- CVE-2015-7566: The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacked a bulk-out endpoint (bnc#961512).\n\nThe following non-security bugs were fixed:\n- acpi / PCI: Account for ARI in _PRT lookups (bsc#968566).\n- af_unix: Guard against other == sk in unix_dgram_sendmsg (bsc#973570).\n- alsa: hrtimer: Handle start/stop more properly (bsc#973378).\n- alsa: oxygen: add Xonar DGX support (bsc#982691).\n- alsa: pcm: Fix potential deadlock in OSS emulation (bsc#968018).\n- alsa: rawmidi: Fix race at copying and updating the position (bsc#968018).\n- alsa: rawmidi: Make snd_rawmidi_transmit() race-free (bsc#968018).\n- alsa: seq: Fix double port list deletion (bsc#968018).\n- alsa: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() (bsc#968018).\n- alsa: seq: Fix leak of pool buffer at concurrent writes (bsc#968018).\n- alsa: seq: Fix lockdep warnings due to double mutex locks (bsc#968018).\n- alsa: seq: Fix race at closing in virmidi driver (bsc#968018).\n- alsa: seq: Fix yet another races among ALSA timer accesses (bsc#968018).\n- alsa: timer: Call notifier in the same spinlock (bsc#973378).\n- alsa: timer: Code cleanup (bsc#968018).\n- alsa: timer: Fix leftover link at closing (bsc#968018).\n- alsa: timer: Fix link corruption due to double start or stop (bsc#968018).\n- alsa: timer: Fix race between stop and interrupt (bsc#968018).\n- alsa: timer: Fix wrong instance passed to slave callbacks (bsc#968018).\n- alsa: timer: Protect the whole snd_timer_close() with open race (bsc#973378).\n- alsa: timer: Sync timer deletion at closing the system timer (bsc#973378).\n- alsa: timer: Use mod_timer() for rearming the system timer (bsc#973378).\n- cgroups: do not attach task to subsystem if migration failed (bnc#979274).\n- cgroups: more safe tasklist locking in cgroup_attach_proc (bnc#979274).\n- cpuset: Fix potential deadlock w/ set_mems_allowed (bsc#960857, bsc#974646).\n- dasd: fix hanging system after LCU changes (bnc#968500, LTC#136671).\n- dcache: use IS_ROOT to decide where dentry is hashed (bsc#949752).\n- Delete patches.drivers/nvme-0165-Split-header-file-into-user-visible-and-kernel-.patch. SLE11-SP4 does not have uapi headers so move everything back to the original header (bnc#981231)\n- Driver: Vmxnet3: set CHECKSUM_UNNECESSARY for IPv6 packets (bsc#976739).\n- enic: set netdev-\u003evlan_features (bsc#966245).\n- fcoe: fix reset of fip selection time (bsc#974787).\n- Fix cifs_uniqueid_to_ino_t() function for s390x (bsc#944309)\n- fs, seqfile: always allow oom killer (bnc#968687).\n- fs/seq_file: fallback to vmalloc allocation (bnc#968687).\n- fs, seq_file: fallback to vmalloc instead of oom kill processes (bnc#968687).\n- hid-elo: kill not flush the work (bnc#982532).\n- hpsa: fix issues with multilun devices (bsc#959381).\n- hv: Assign correct -\u003ecan_queue value in hv_storvsc (bnc#969391)\n- ibmvscsi: Remove unsupported host config MAD (bsc#973556).\n- Import kabi files from kernel 3.0.101-71\n- iommu/vt-d: Improve fault handler error messages (bsc#975772).\n- iommu/vt-d: Ratelimit fault handler (bsc#975772).\n- ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits (bsc#967914).\n- ipv4/fib: do not warn when primary address is missing if in_dev is dead (bsc#971360).\n- ipv4: fix ineffective source address selection (bsc#980788).\n- ipv6: make fib6 serial number per namespace (bsc#965319).\n- ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs (bsc#956852).\n- ipv6: per netns fib6 walkers (bsc#965319).\n- ipv6: per netns FIB garbage collection (bsc#965319).\n- ipv6: replace global gc_args with local variable (bsc#965319).\n- ipvs: count pre-established TCP states as active (bsc#970114).\n- isofs: Revert 'get_rock_ridge_filename(): handle malformed NM entries' This reverts commit cb6ce3ec7a964e56da9ba9cd3c9f0e708b5c3b2c. It should have never landed in the tree (we already have the patch via c63531c60ff that came through CVE branch), but I messed up the merge.\n- kabi, fs/seq_file: fallback to vmalloc allocation (bnc#968687).\n- kabi: protect struct netns_ipv6 after FIB6 GC series (bsc#965319).\n- KVM: x86: fix maintenance of guest/host xcr0 state (bsc#961518).\n- llist: Add llist_next().\n- make vfree() safe to call from interrupt contexts .\n- memcg: do not hang on OOM when killed by userspace OOM access to memory reserves (bnc#969571).\n- mld, igmp: Fix reserved tailroom calculation (bsc#956852).\n- mm/hugetlb.c: correct missing private flag clearing (VM Functionality, bnc#971446).\n- mm/hugetlb: fix backport of upstream commit 07443a85ad (VM Functionality, bnc#971446).\n- MM: increase safety margin provided by PF_LESS_THROTTLE (bsc#956491).\n- mm/vmscan.c: avoid throttling reclaim for loop-back nfsd threads (bsc#956491).\n- net/core: dev_mc_sync_multiple calls wrong helper (bsc#971433).\n- net/core: __hw_addr_create_ex does not initialize sync_cnt (bsc#971433).\n- net/core: __hw_addr_sync_one / _multiple broken (bsc#971433).\n- net/core: __hw_addr_unsync_one 'from' address not marked synced (bsc#971433).\n- NFS4: treat lock owners as opaque values (bnc#968141).\n- NFS: avoid deadlocks with loop-back mounted NFS filesystems (bsc#956491).\n- NFS: avoid waiting at all in nfs_release_page when congested (bsc#956491).\n- NFSd4: return nfserr_symlink on v4 OPEN of non-regular file (bsc#973237).\n- NFSd: do not fail unchecked creates of non-special files (bsc#973237).\n- NFS: Do not attempt to decode missing directory entries (bsc#980931).\n- nfs: fix memory corruption rooted in get_ih_name pointer math (bsc#984107).\n- NFS: reduce access cache shrinker locking (bnc#866130).\n- NFS: use smaller allocations for 'struct idmap' (bsc#965923).\n- NFSv4: Ensure that we do not drop a state owner more than once (bsc#979595).\n- nfsv4: OPEN must handle the NFS4ERR_IO return code correctly (bsc#979595).\n- nvme: fix max_segments integer truncation (bsc#676471).\n- NVMe: Unify controller probe and resume (bsc#979347).\n- ocfs2: do not set fs read-only if rec[0] is empty while committing truncate (bnc#971947).\n- ocfs2: extend enough credits for freeing one truncate record while replaying truncate records (bnc#971947).\n- ocfs2: extend transaction for ocfs2_remove_rightmost_path() and ocfs2_update_edge_lengths() before to avoid inconsistency between inode and et (bnc#971947).\n- pciback: check PF instead of VF for PCI_COMMAND_MEMORY (bsc#957990).\n- pciback: Save the number of MSI-X entries to be copied later (bsc#957988).\n- PCI: Move pci_ari_enabled() to global header (bsc#968566).\n- RDMA/ucma: Fix AB-BA deadlock (bsc#963998).\n- Restore kabi after lock-owner change (bnc#968141).\n- rpm/modprobe-xen.conf: Revert comment change to allow parallel install (bsc#957986). This reverts commit 855c7ce885fd412ce2a25ccc12a46e565c83f235.\n- s390/dasd: prevent incorrect length error under z/VM after PAV changes (bnc#968500, LTC#136670).\n- s390/pageattr: Do a single TLB flush for change_page_attr (bsc#940413).\n- s390/pci: add extra padding to function measurement block (bnc#968500, LTC#139445).\n- s390/pci_dma: fix DMA table corruption with \u003e 4 TB main memory (bnc#968500, LTC#139401).\n- s390/pci_dma: handle dma table failures (bnc#968500, LTC#139442).\n- s390/pci_dma: improve debugging of errors during dma map (bnc#968500, LTC#139442).\n- s390/pci_dma: unify label of invalid translation table entries (bnc#968500, LTC#139442).\n- s390/pci: enforce fmb page boundary rule (bnc#968500, LTC#139445).\n- s390/pci: extract software counters from fmb (bnc#968500, LTC#139445).\n- s390/pci: remove pdev pointer from arch data (bnc#968500, LTC#139444).\n- s390/spinlock: avoid yield to non existent cpu (bnc#968500, LTC#141106).\n- scsi_dh_alua: Do not block request queue if workqueue is active (bsc#960458).\n- SCSI: Increase REPORT_LUNS timeout (bsc#971989).\n- SCSI mpt2sas: Rearrange the the code so that the completion queues are initialized prior to sending the request to controller firmware (bsc#967863).\n- skb: Add inline helper for getting the skb end offset from head (bsc#956852).\n- tcp: avoid order-1 allocations on wifi and tx path (bsc#956852).\n- tcp: fix skb_availroom() (bsc#956852).\n- Tidy series.conf, p5 Only one last patch which can be moved easily. There are some more x86-related things left at the end but moving them won't be that trivial.\n- Update patches.drivers/nvme-0265-fix-max_segments-integer-truncation.patch (bsc#979419). Fix reference.\n- Update patches.fixes/bnx2x-Alloc-4k-fragment-for-each-rx-ring-buffer-elem.patch (bsc#953369 bsc#975358).\n- Update PCI VPD size patch to upstream: - PCI: Determine actual VPD size on first access (bsc#971729). - PCI: Update VPD definitions (bsc#971729).\n- USB: usbip: fix potential out-of-bounds write (bnc#975945).\n- veth: do not modify ip_summed (bsc#969149).\n- vgaarb: Add more context to error messages (bsc#976868).\n- virtio_scsi: Implement eh_timed_out callback (bsc#936530).\n- vmxnet3: set carrier state properly on probe (bsc#972363).\n- vmxnet3: set netdev parant device before calling netdev_info (bsc#972363).\n- x86, kvm: fix kvm's usage of kernel_fpu_begin/end() (bsc#961518).\n- x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu() (bsc#961518).\n- xfrm: do not segment UFO packets (bsc#946122).\n- xfs: fix sgid inheritance for subdirectories inheriting default acls [V3] (bsc#965860).\n- xhci: Workaround to get Intel xHCI reset working more reliably (bnc#898592).\n","status":"published","published":"2016-06-24T10:34:15Z","modified":"2026-02-04T04:32:04.642536Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1985-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 11 SP4 RT kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n- CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call (bnc#986572).\n- CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bnc#986362).\n- CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bnc#984755).\n- CVE-2016-5244: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel did not initialize a certain structure member, which allowed remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message (bnc#983213).\n- CVE-2016-1583: The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling (bnc#983143).\n- CVE-2016-4913: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel mishandled NM (aka alternate name) entries containing \\0 characters, which allowed local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem (bnc#980725).\n- CVE-2016-4580: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel did not properly initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request (bnc#981267).\n- CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions (bnc#980371).\n- CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in the Linux kernel allowed local users to gain privileges via crafted ASN.1 data (bnc#979867).\n- CVE-2015-7833: The usbvision driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor (bnc#950998).\n- CVE-2016-3707: The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, allowed remote attackers to execute SysRq commands via crafted ICMP Echo Request packets, as demonstrated by a brute-force attack to discover a cookie, or an attack that occurs after reading the local icmp_echo_sysrq file (bnc#980246).\n- CVE-2016-2187: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971944).\n- CVE-2016-4482: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call (bnc#978401).\n- CVE-2016-2053: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel allowed attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c (bnc#963762).\n- CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relied on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bnc#979548).\n- CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel did not initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory by reading a message (bnc#978821).\n- CVE-2016-4578: sound/core/timer.c in the Linux kernel did not initialize certain r1 data structures, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions (bnc#979879).\n- CVE-2016-4569: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface (bnc#979213).\n- CVE-2016-4486: The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#978822).\n- CVE-2016-3134: The netfilter subsystem in the Linux kernel did not validate certain offset fields, which allowed local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call (bnc#971126).\n\nThe following non-security bugs were fixed:\n- ALSA: hrtimer: Handle start/stop more properly (bsc#973378).\n- ALSA: oxygen: add Xonar DGX support (bsc#982691).\n- Assign correct -\u003ecan_queue value in hv_storvsc (bnc#969391)\n- Delete patches.drivers/nvme-0165-Split-header-file-into-user-visible-and-kernel-.patch. SLE11-SP4 does not have uapi headers so move everything back to the original header (bnc#981231)\n- Driver: Vmxnet3: set CHECKSUM_UNNECESSARY for IPv6 packets (bsc#976739).\n- Fix cifs_uniqueid_to_ino_t() function for s390x (bsc#944309)\n- KVM: x86: fix maintenance of guest/host xcr0 state (bsc#961518).\n- MM: increase safety margin provided by PF_LESS_THROTTLE (bsc#956491).\n- NFS: Do not attempt to decode missing directory entries (bsc#980931).\n- NFS: avoid deadlocks with loop-back mounted NFS filesystems (bsc#956491).\n- NFS: avoid waiting at all in nfs_release_page when congested (bsc#956491).\n- NFS: fix memory corruption rooted in get_ih_name pointer math (bsc#984107).\n- NFS: reduce access cache shrinker locking (bnc#866130).\n- NFSv4: Ensure that we do not drop a state owner more than once (bsc#979595).\n- NFSv4: OPEN must handle the NFS4ERR_IO return code correctly (bsc#979595).\n- NVMe: Unify controller probe and resume (bsc#979347).\n- RDMA/cxgb4: Configure 0B MRs to match HW implementation (bsc#909589).\n- RDMA/cxgb4: Do not hang threads forever waiting on WR replies (bsc#909589).\n- RDMA/cxgb4: Fix locking issue in process_mpa_request (bsc#909589).\n- RDMA/cxgb4: Handle NET_XMIT return codes (bsc#909589).\n- RDMA/cxgb4: Increase epd buff size for debug interface (bsc#909589).\n- RDMA/cxgb4: Limit MRs to less than 8GB for T4/T5 devices (bsc#909589).\n- RDMA/cxgb4: Serialize CQ event upcalls with CQ destruction (bsc#909589).\n- RDMA/cxgb4: Wake up waiters after flushing the qp (bsc#909589).\n- SCSI: Increase REPORT_LUNS timeout (bsc#971989).\n- Update patches.drivers/nvme-0265-fix-max_segments-integer-truncation.patch (bsc#979419). Fix reference.\n- Update patches.fixes/bnx2x-Alloc-4k-fragment-for-each-rx-ring-buffer-elem.patch (bsc#953369 bsc#975358).\n- bridge: superfluous skb-\u003enfct check in br_nf_dev_queue_xmit (bsc#982544).\n- cgroups: do not attach task to subsystem if migration failed (bnc#979274).\n- cgroups: more safe tasklist locking in cgroup_attach_proc (bnc#979274).\n- cpuset: Fix potential deadlock w/ set_mems_allowed (bsc#960857, bsc#974646).\n- dasd: fix hanging system after LCU changes (bnc#968500, LTC#136671).\n- enic: set netdev-\u003evlan_features (bsc#966245).\n- fcoe: fix reset of fip selection time (bsc#974787).\n- hid-elo: kill not flush the work (bnc#982532).\n- ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits (bsc#967914).\n- ipv4/fib: do not warn when primary address is missing if in_dev is dead (bsc#971360).\n- ipv4: fix ineffective source address selection (bsc#980788).\n- ipvs: count pre-established TCP states as active (bsc#970114).\n- iucv: call skb_linearize() when needed (bnc#979915, LTC#141240).\n- kabi: prevent spurious modversion changes after bsc#982544 fix (bsc#982544).\n- mm/hugetlb.c: correct missing private flag clearing (VM Functionality, bnc#971446).\n- mm/hugetlb: fix backport of upstream commit 07443a85ad (VM Functionality, bnc#971446).\n- mm/swap.c: flush lru pvecs on compound page arrival (bnc#983721).\n- mm/vmscan.c: avoid throttling reclaim for loop-back nfsd threads (bsc#956491).\n- mm: Fix DIF failures on ext3 filesystems (bsc#971030).\n- net/qlge: Avoids recursive EEH error (bsc#954847).\n- netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in br_validate_ipv6 (bsc#982544).\n- netfilter: bridge: do not leak skb in error paths (bsc#982544).\n- netfilter: bridge: forward IPv6 fragmented packets (bsc#982544).\n- nvme: fix max_segments integer truncation (bsc#676471).\n- ocfs2: do not set fs read-only if rec[0] is empty while committing truncate (bnc#971947).\n- ocfs2: extend enough credits for freeing one truncate record while replaying truncate records (bnc#971947).\n- ocfs2: extend transaction for ocfs2_remove_rightmost_path() and ocfs2_update_edge_lengths() before to avoid inconsistency between inode and et (bnc#971947).\n- qeth: delete napi struct when removing a qeth device (bnc#979915, LTC#143590).\n- rpm/modprobe-xen.conf: Revert comment change to allow parallel install (bsc#957986). This reverts commit 855c7ce885fd412ce2a25ccc12a46e565c83f235.\n- s390/dasd: prevent incorrect length error under z/VM after PAV changes (bnc#968500, LTC#136670).\n- s390/mm: fix asce_bits handling with dynamic pagetable levels (bnc#979915, LTC#141456).\n- s390/pci: add extra padding to function measurement block (bnc#968500, LTC#139445).\n- s390/pci: enforce fmb page boundary rule (bnc#968500, LTC#139445).\n- s390/pci: extract software counters from fmb (bnc#968500, LTC#139445).\n- s390/pci: fix use after free in dma_init (bnc#979915, LTC#141626).\n- s390/pci: remove pdev pointer from arch data (bnc#968500, LTC#139444).\n- s390/pci_dma: fix DMA table corruption with \u003e 4 TB main memory (bnc#968500, LTC#139401).\n- s390/pci_dma: handle dma table failures (bnc#968500, LTC#139442).\n- s390/pci_dma: improve debugging of errors during dma map (bnc#968500, LTC#139442).\n- s390/pci_dma: unify label of invalid translation table entries (bnc#968500, LTC#139442).\n- s390/spinlock: avoid yield to non existent cpu (bnc#968500, LTC#141106).\n- s390: fix test_fp_ctl inline assembly contraints (bnc#979915, LTC#143138).\n- sched/cputime: Fix clock_nanosleep()/clock_gettime() inconsistency (bnc#988498).\n- sched/cputime: Fix cpu_timer_sample_group() double accounting (bnc#988498).\n- sched: Provide update_curr callbacks for stop/idle scheduling classes (bnc#988498).\n- veth: do not modify ip_summed (bsc#969149).\n- vgaarb: Add more context to error messages (bsc#976868).\n- virtio_scsi: Implement eh_timed_out callback (bsc#936530).\n- x86, kvm: fix kvm's usage of kernel_fpu_begin/end() (bsc#961518).\n- x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu() (bsc#961518).\n- x86/mm/pat, /dev/mem: Remove superfluous error message (bsc#974620).\n","status":"published","published":"2016-08-08T14:55:45Z","modified":"2026-02-04T02:33:12.814409Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2245-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n- CVE-2016-3955: The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel allowed remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet (bnc#975945).\n- CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary (bnc#986365).\n- CVE-2015-7513: arch/x86/kvm/x86.c in the Linux kernel did not reset the PIT counter values during state restoration, which allowed guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions (bnc#960689).\n- CVE-2013-4312: The Linux kernel allowed local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c (bnc#839104).\n- CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bnc#986362).\n- CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call (bnc#986572).\n- CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure was initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bnc#984755).\n- CVE-2016-5244: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel did not initialize a certain structure member, which allowed remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message (bnc#983213).\n- CVE-2016-1583: The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling (bnc#983143).\n- CVE-2016-4913: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel mishandled NM (aka alternate name) entries containing \\0 characters, which allowed local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem (bnc#980725).\n- CVE-2016-4580: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel did not properly initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request (bnc#981267).\n- CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions (bnc#980371).\n- CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in the Linux kernel allowed local users to gain privileges via crafted ASN.1 data (bnc#979867).\n- CVE-2015-7833: The usbvision driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor (bnc#950998).\n- CVE-2016-2187: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971944).\n- CVE-2016-4482: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call (bnc#978401).\n- CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relies on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bnc#979548).\n- CVE-2016-2053: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel allowed attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c (bnc#963762).\n- CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel did not initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory by reading a message (bnc#978821).\n- CVE-2016-4578: sound/core/timer.c in the Linux kernel did not initialize certain r1 data structures, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions (bnc#979879).\n- CVE-2016-4569: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface (bnc#979213).\n- CVE-2016-4486: The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#978822).\n- CVE-2016-3134: The netfilter subsystem in the Linux kernel did not validate certain offset fields, which allowed local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call (bnc#971126).\n- CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel did not properly determine the rate of challenge ACK segments, which made it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. (bsc#989152)\n- CVE-2016-6480: Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a 'double fetch' vulnerability. (bsc#991608)\n\nThe following non-security bugs were fixed:\n- Update patches.fixes/pci-determine-actual-vpd-size-on-first-access.patch (bsc#971729, bsc#974428).\n- Update PCI VPD size patch to upstream: \n  * PCI: Determine actual VPD size on first access (bsc#971729). \n  * PCI: Update VPD definitions (bsc#971729). (cherry picked from commit d2af5b7e0cd7ee2a54f02ad65ec300d16b3ad956)\n- Update patches.fixes/pci-update-vpd-definitions.patch (bsc#971729, bsc#974428).\n- cgroups: do not attach task to subsystem if migration failed (bnc#979274).\n- cgroups: more safe tasklist locking in cgroup_attach_proc (bnc#979274).\n- fs/cifs: Fix cifs_uniqueid_to_ino_t() function for s390x (bsc#944309)\n- fs/cifs: fix wrongly prefixed path to root (bsc#963655, bsc#979681)\n- hid: add ALWAYS_POLL quirk for a Logitech 0xc055 (bnc#962404).\n- hid: add HP OEM mouse to quirk ALWAYS_POLL (bsc#919351).\n- hid: add quirk for PIXART OEM mouse used by HP (bsc#919351).\n- hid-elo: kill not flush the work.\n- ipv4/fib: do not warn when primary address is missing if in_dev is dead (bsc#971360).\n- ipv4: fix ineffective source address selection (bsc#980788).\n- ipvs: count pre-established TCP states as active (bsc#970114).\n- kabi, unix: properly account for FDs passed over unix sockets (bnc#839104).\n- mm/hugetlb.c: correct missing private flag clearing (VM Functionality, bnc#971446).\n- mm/hugetlb: fix backport of upstream commit 07443a85ad (VM Functionality, bnc#971446).\n- mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED (VM Functionality, bnc#986445).\n- nfs: Do not attempt to decode missing directory entries (bsc#980931).\n- nfs: fix memory corruption rooted in get_ih_name pointer math (bsc#984107).\n- nfs: reduce access cache shrinker locking (bnc#866130).\n- ppp: defer netns reference release for ppp channel (bsc#980371).\n- s390/cio: collect format 1 channel-path description data (bsc#966460,LTC#136434).\n- s390/cio: ensure consistent measurement state (bsc#966460,LTC#136434).\n- s390/cio: fix measurement characteristics memleak (bsc#966460,LTC#136434).\n- s390/cio: update measurement characteristics (bsc#966460,LTC#136434).\n- usbhid: add device USB_DEVICE_ID_LOGITECH_C077 (bsc#919351).\n- usbhid: more mice with ALWAYS_POLL (bsc#919351).\n- usbhid: yet another mouse with ALWAYS_POLL (bsc#919351).\n- veth: do not modify ip_summed (bsc#969149).\n- virtio_scsi: Implement eh_timed_out callback.\n- vmxnet3: segCnt can be 1 for LRO packets (bsc#988065).\n- xfs: Avoid grabbing ilock when file size is not changed (bsc#983535).\n- xfs: avoid xfs_buf hang in lookup node directory corruption (bsc#989401).\n- xfs: only update the last_sync_lsn when a transaction completes (bsc#987709).\n","status":"published","published":"2016-09-06T09:28:39Z","modified":"2025-05-02T04:03:58.555675Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2017:0333-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 11 SP2 LTSS kernel was updated to receive various security and bugfixes.\n\nThis is the last planned LTSS kernel update for the SUSE Linux Enterprise Server 11 SP2 LTSS.\n\nThe following security bugs were fixed:\n\n- CVE-2016-10088: The sg implementation in the Linux kernel did not properly restrict write operations in situations where the KERNEL_DS option is set, which allowed local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576 (bnc#1017710).\n- CVE-2004-0230: TCP, when using a large Window Size, made it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP (bnc#969340).\n- CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c in the Linux kernel did not validate the relationship between the minimum fragment length and the maximum packet size, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability (bnc#1008831).\n- CVE-2016-8399: An out of bounds read in the ping protocol handler could have lead to information disclosure (bsc#1014746).\n- CVE-2016-9793: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option (bnc#1013531).\n- CVE-2012-6704: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option (bnc#1013542).\n- CVE-2016-9756: arch/x86/kvm/emulate.c in the Linux kernel did not properly initialize Code Segment (CS) in certain error cases, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application (bnc#1013038).\n- CVE-2016-3841: The IPv6 stack in the Linux kernel mishandled options data, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call (bnc#992566).\n- CVE-2016-9685: Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel allowed local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations (bnc#1012832).\n- CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecified removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939).\n- CVE-2015-8962: Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call (bnc#1010501).\n- CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacked chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bnc#1011685).\n- CVE-2016-7910: Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel allowed local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed (bnc#1010716).\n- CVE-2016-7911: Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call (bnc#1010711).\n- CVE-2015-8964: The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a tty data structure (bnc#1010507).\n- CVE-2016-7916: Race condition in the environ_read function in fs/proc/base.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete (bnc#1010467).\n- CVE-2016-8646: The hash_accept function in crypto/algif_hash.c in the Linux kernel allowed local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data (bnc#1010150).\n- CVE-2016-8633: drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allowed remote attackers to execute arbitrary code via crafted fragmented packets (bnc#1008833).\n- CVE-2016-7042: The proc_keys_show function in security/keys/proc.c in the Linux kernel used an incorrect buffer size for certain timeout data, which allowed local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file (bnc#1004517).\n- CVE-2016-7097: The filesystem implementation in the Linux kernel preserves the setgid bit during a setxattr call, which allowed local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions (bnc#995968).\n- CVE-2017-5551: The filesystem implementation in the Linux kernel preserves the setgid bit during a setxattr call, which allowed local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. This CVE tracks the fix for the tmpfs filesystem. (bsc#1021258).\n- CVE-2015-8956: The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel allowed local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket (bnc#1003925).\n- CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077).\n- CVE-2016-0823: The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel allowed local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721 (bnc#994759).\n- CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did not restrict a certain length field, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).\n- CVE-2016-6828: The tcp_check_send_head function in include/net/tcp.h in the Linux kernel did not properly maintain certain SACK state after a failed data copy, which allowed local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option (bnc#994296).\n- CVE-2016-6480: Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a 'double fetch' vulnerability (bnc#991608).\n- CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary (bsc#986365).\n- CVE-2015-7513: arch/x86/kvm/x86.c in the Linux kernel did not reset the PIT counter values during state restoration, which allowed guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions (bnc#960689).\n- CVE-2013-4312: The Linux kernel allowed local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c (bnc#839104).\n- CVE-2016-4997: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bnc#986362).\n- CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call (bnc#986572).\n- CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bnc#984755).\n- CVE-2016-5244: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel did not initialize a certain structure member, which allowed remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message (bnc#983213).\n- CVE-2016-1583: The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling (bnc#983143).\n- CVE-2016-4913: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel mishandled NM (aka alternate name) entries containing \\0 characters, which allowed local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem (bnc#980725).\n- CVE-2016-4580: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel did not properly initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request (bnc#981267).\n- CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions (bnc#980371).\n- CVE-2015-7833: The usbvision driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor (bnc#950998).\n- CVE-2016-2187: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971944).\n- CVE-2016-4482: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call (bnc#978401).\n- CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relies on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bnc#979548).\n- CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel did not initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory by reading a message (bnc#978821).\n- CVE-2016-4578: sound/core/timer.c in the Linux kernel did not initialize certain r1 data structures, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions (bnc#979879).\n- CVE-2016-4569: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface (bnc#979213).\n\n\nThe following non-security bugs were fixed:\n\n- arch/powerpc: Remove duplicate/redundant Altivec entries (bsc#967716).\n- cdc-acm: added sanity checking for probe() (bsc#993891).\n- cgroups: do not attach task to subsystem if migration failed (bnc#979274).\n- cgroups: more safe tasklist locking in cgroup_attach_proc (bnc#979274).\n- dasd: fix hanging system after LCU changes (bnc#968500, LTC#136671).\n- dasd: Fix unresumed device after suspend/resume (bnc#927287, LTC#123892).\n- ipv4/fib: do not warn when primary address is missing if in_dev is dead (bsc#971360).\n- kabi, unix: properly account for FDs passed over unix sockets (bnc#839104).\n- kaweth: fix firmware download (bsc#993890).\n- kaweth: fix oops upon failed memory allocation (bsc#993890).\n- kvm: x86: SYSENTER emulation is broken (bsc#994618).\n- mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED (VM Functionality, bnc#986445).\n- mremap: enforce rmap src/dst vma ordering in case of vma_merge() succeeding in copy_vma() (VM Functionality, bsc#1008645).\n- nfs4: reset states to use open_stateid when returning delegation voluntarily (bsc#1007944).\n- nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261, bsc#1011482).\n- nfs: do not do blind d_drop() in nfs_prime_dcache() (bnc#908069 bnc#896484 bsc#963053).\n- nfs_prime_dcache needs fh to be set (bnc#908069 bnc#896484 bsc#963053).\n- nfs: Refresh open-owner id when server says SEQID is bad (bsc#989261).\n- nfsv4: Ensure that we do not drop a state owner more than once (bsc#979595).\n- nfsv4: fix broken patch relating to v4 read delegations (bsc#956514, bsc#989261, bsc#979595, bsc#1011482).\n- nfsv4: nfs4_proc_renew should be declared static (bnc#863873).\n- nfsv4: OPEN must handle the NFS4ERR_IO return code correctly (bsc#979595).\n- nfsv4: Recovery of recalled read delegations is broken (bsc#956514 bsc#1011482).\n- nfsv4: The NFSv4.0 client must send RENEW calls if it holds a delegation (bnc#863873).\n- powerpc: Add ability to build little endian kernels (bsc#967716).\n- powerpc: Avoid load of static chain register when calling nested functions through a pointer on 64bit (bsc#967716).\n- powerpc: Do not build assembly files with ABIv2 (bsc#967716).\n- powerpc: Do not use ELFv2 ABI to build the kernel (bsc#967716).\n- powerpc: dtc is required to build dtb files (bsc#967716).\n- powerpc: Fix 64 bit builds with binutils 2.24 (bsc#967716).\n- powerpc: Fix error when cross building TAGS \u0026 cscope (bsc#967716).\n- powerpc: Make the vdso32 also build big-endian (bsc#967716).\n- powerpc: Remove altivec fix for gcc versions before 4.0 (bsc#967716).\n- powerpc: Remove buggy 9-year-old test for binutils \u003c 2.12.1 (bsc#967716).\n- powerpc: Require gcc 4.0 on 64-bit (bsc#967716).\n- ppp: defer netns reference release for ppp channel (bsc#980371).\n- qeth: delete napi struct when removing a qeth device (bnc#979915, LTC#143590).\n- qeth: Fix crash on initial MTU size change (bnc#835175, LTC#96809).\n- qeth: postpone freeing of qdio memory (bnc#874145, LTC#107873).\n- rpm/kernel-binary.spec.in: Export a make-stderr.log file (bsc#1012422)\n- Revert 's390/mm: fix asce_bits handling with dynamic pagetable levels' This reverts commit 6e00b1d803fa2ab4b130e04b7fbcc99f0b5ecba8.\n- rpm/config.sh: Set the release string to 0.7.\u003cRELEASE\u003e (bsc#997059)\n- rpm/mkspec: Read a default release string from rpm/config.sh (bsc997059)\n- s390/dasd: fix failfast for disconnected devices (bnc#958000, LTC#135138).\n- s390/dasd: fix hanging device after clear subchannel (bnc#994436, LTC#144640).\n- s390/dasd: fix kernel panic when alias is set offline (bnc#940966, LTC#128595).\n- s390/dasd: fix list_del corruption after lcu changes (bnc#954984, LTC#133077).\n- s390/mm: fix asce_bits handling with dynamic pagetable levels (bnc#979915, LTC#141456). Conflicts: \tseries.conf\n- s390/pageattr: do a single TLB flush for change_page_attr (bsc#1009443,LTC#148182).\n- Set CONFIG_DEBUG_INFO=y and CONFIG_DEBUG_INFO_REDUCED=n on all platforms The specfile adjusts the config if necessary, but a new version of run_oldconfig.sh requires the settings to be present in the repository.\n- usb: fix typo in wMaxPacketSize validation (bsc#991665).\n- usb: validate wMaxPacketValue entries in endpoint descriptors (bnc#991665).\n","status":"published","published":"2017-01-30T16:03:00Z","modified":"2026-02-04T03:14:57.481892Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3016-1","title":"linux vulnerabilities","description":"Jesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nBaozeng Ding discovered that the Transparent Inter-process Communication\n(TIPC) implementation in the Linux kernel did not verify socket existence\nbefore use in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-4951)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T19:46:50Z","modified":"2026-04-22T09:25:34.59295Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3016-2","title":"linux-raspi2 vulnerabilities","description":"Jesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nBaozeng Ding discovered that the Transparent Inter-process Communication\n(TIPC) implementation in the Linux kernel did not verify socket existence\nbefore use in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-4951)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T19:53:24Z","modified":"2026-02-10T04:41:01Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3016-3","title":"linux-snapdragon vulnerabilities","description":"Jesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nBaozeng Ding discovered that the Transparent Inter-process Communication\n(TIPC) implementation in the Linux kernel did not verify socket existence\nbefore use in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-4951)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T20:01:57Z","modified":"2026-02-10T04:41:01Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3016-4","title":"linux-lts-xenial vulnerabilities","description":"USN-3016-1 fixed vulnerabilities in the Linux kernel for Ubuntu\n16.04 LTS. This update provides the corresponding updates for the\nLinux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for\nUbuntu 14.04 LTS.\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nBaozeng Ding discovered that the Transparent Inter-process Communication\n(TIPC) implementation in the Linux kernel did not verify socket existence\nbefore use in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-4951)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T20:55:14Z","modified":"2026-02-10T04:41:01Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3017-3","title":"linux-lts-wily vulnerabilities","description":"USN-3017-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS.\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nBaozeng Ding discovered that the Transparent Inter-process Communication\n(TIPC) implementation in the Linux kernel did not verify socket existence\nbefore use in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-4951)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T20:49:54Z","modified":"2026-02-10T04:41:01Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3018-1","title":"linux vulnerabilities","description":"Jesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nJann Horn discovered that the InfiniBand interfaces within the Linux kernel\ncould be coerced into overwriting kernel memory. A local unprivileged\nattacker could use this to possibly gain administrative privileges on\nsystems where InifiniBand related kernel modules are loaded.\n(CVE-2016-4565)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T21:11:46Z","modified":"2026-04-22T09:25:19.832118Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3019-1","title":"linux-lts-utopic vulnerabilities","description":"Jesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nJann Horn discovered that the InfiniBand interfaces within the Linux kernel\ncould be coerced into overwriting kernel memory. A local unprivileged\nattacker could use this to possibly gain administrative privileges on\nsystems where InifiniBand related kernel modules are loaded.\n(CVE-2016-4565)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T21:26:32Z","modified":"2026-02-10T04:41:01Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3020-1","title":"linux-lts-vivid vulnerabilities","description":"Jesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling 32 bit\ncompatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local\nunprivileged attacker could use this to cause a denial of service (system\ncrash) or execute arbitrary code with administrative privileges.\n(CVE-2016-4997)\n\nKangjie Lu discovered an information leak in the core USB implementation in\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4482)\n\nKangjie Lu discovered an information leak in the timer handling\nimplementation in the Advanced Linux Sound Architecture (ALSA) subsystem of\nthe Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4569, CVE-2016-4578)\n\nKangjie Lu discovered an information leak in the X.25 Call Request handling\nin the Linux kernel. A local attacker could use this to obtain potentially\nsensitive information from kernel memory. (CVE-2016-4580)\n\nIt was discovered that an information leak exists in the Rock Ridge\nimplementation in the Linux kernel. A local attacker who is able to mount a\nmalicious iso9660 file system image could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2016-4913)\n\nBaozeng Ding discovered that the Transparent Inter-process Communication\n(TIPC) implementation in the Linux kernel did not verify socket existence\nbefore use in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-4951)\n\nJesse Hertz and Tim Newsham discovered that the Linux netfilter\nimplementation did not correctly perform validation when handling\nIPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to\ncause a denial of service (system crash) or obtain potentially sensitive\ninformation from kernel memory. (CVE-2016-4998)\n","status":"published","published":"2016-06-27T21:30:34Z","modified":"2026-02-10T04:41:01Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}