huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-9083: kernel: State machine confusion bug in vfio driver leading to memory corruption
Component: kernel
Severity: Important
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2016-10-12T00:00:00+00:00

A flaw was discovered in the Linux kernel's implementation of VFIO. An attacker issuing an ioctl can create a situation where memory is corrupted and modify memory outside of the expected area. This may overwrite kernel memory and subvert kernel execution.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7. This has been rated as having Moderate security impact and is  currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 05692d7005a364add85c6e25a6c4447ce08f913a
CVE-2016-9084: kernel: Integer overflow when using kzalloc in vfio driver
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2016-10-12T00:00:00+00:00

The use of a kzalloc with an integer multiplication allowed an integer overflow condition to be reached in vfio_pci_intrs.c. This combined with CVE-2016-9083 may allow an attacker to craft an attack and use unallocated memory, potentially crashing the machine.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7. This has been rated as having Moderate security impact and is  currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 05692d7005a364add85c6e25a6c4447ce08f913a
CVE-2016-9262: jasper: integer truncation in jas_image_cmpt_create()
Component: jasper
Severity: Moderate
CWE: CWE-681 (Incorrect Conversion between Numeric Types)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-11-06T00:00:00+00:00

Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 634ce8e8a5accc0fa05dd2c20d42b4749d4b2735
CVE-2016-9387: jasper: integer overflow in jpc_dec_process_siz()
Component: jasper
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 2.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
Public date: 2016-10-23T00:00:00+00:00

Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: d91198abd00fc435a397fe6bad906a4c1748e9cf
CVE-2016-9388: jasper: reachable assertions in RAS encoder/decoder
Component: jasper
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-24T00:00:00+00:00

The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 411a4068f8c464e883358bf403a3e25158863823
CVE-2016-9389: jasper: reachable assertions caused by insufficient component domains checks in ICT/RCT in JPC codec
Component: jasper
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-24T00:00:00+00:00

The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: dee11ec440d7908d1daf69f40a3324b27cf213ba
CVE-2016-9390: jasper: insufficient SIZ marker tilexoff and tileyoff checks
Component: jasper
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-24T00:00:00+00:00

The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: ba2b9d000660313af7b692542afbd374c5685865
CVE-2016-9391: jasper: reachable assertions in the JPC bitstream code
Component: jasper
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-25T00:00:00+00:00

The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 1e84674d95353c64e5c4c0e7232ae86fd6ea813b
CVE-2016-9392: jasper: insufficient SIZ marker segment data sanity checks
Component: jasper
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-28T00:00:00+00:00

The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: f7038068550fba0e41e1d0c355787f1dcd5bf330
CVE-2016-9393: jasper: insufficient SIZ marker segment data sanity checks
Component: jasper
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-28T00:00:00+00:00

The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: f7038068550fba0e41e1d0c355787f1dcd5bf330
CVE-2016-9394: jasper: insufficient SIZ marker segment data sanity checks
Component: jasper
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-28T00:00:00+00:00

The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: f7038068550fba0e41e1d0c355787f1dcd5bf330
CVE-2016-9445: gstreamer-plugins-bad-free: Integer overflow when allocating render buffer in VMnc decoder
Component: gstreamer-plugins-bad-free
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-11-15T00:00:00+00:00

An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c
Upstream fix commit: 4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe
CVE-2016-9446: gstreamer-plugins-bad-free: Missing initialization of allocated heap memory leads to information leak
Component: gstreamer-plugins-bad-free
Severity: Low
CWE: CWE-456 (Missing Initialization of a Variable)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2016-11-15T00:00:00+00:00

The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c
Upstream fix commit: 4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe
CVE-2016-9533: libtiff: PixarLog horizontalDifference heap-buffer-overflow
Component: libtiff
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-09-24T00:00:00+00:00

tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference heap-buffer-overflow."


Affected upstream versions: n/a
Fixed upstream versions: Release-v4-0-7
Upstream repository: https://github.com/vadz/libtiff
Upstream fix commit: 83a4b92815ea04969d494416eaae3d4c6b338e4a
CVE-2016-9534: libtiff: TIFFFlushData1 heap-buffer-overflow
Component: libtiff
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-09-24T00:00:00+00:00

tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."


Affected upstream versions: n/a
Fixed upstream versions: Release-v4-0-7
Upstream repository: https://github.com/vadz/libtiff
Upstream fix commit: 83a4b92815ea04969d494416eaae3d4c6b338e4a
CVE-2016-9535: libtiff: Predictor heap-buffer-overflow
Component: libtiff
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-11-04T00:00:00+00:00

tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."


Affected upstream versions: n/a
Fixed upstream versions: Release-v4-0-7
Upstream repository: https://github.com/vadz/libtiff
Upstream fix commit: 3ca657a8793dd011bf869695d72ad31c779c3cc1
CVE-2016-9536: libtiff: t2p_process_jpeg_strip heap-buffer-overflow
Component: libtiff
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-09-24T00:00:00+00:00

tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."


Affected upstream versions: n/a
Fixed upstream versions: Release-v4-0-7
Upstream repository: https://github.com/vadz/libtiff
Upstream fix commit: 83a4b92815ea04969d494416eaae3d4c6b338e4a
CVE-2016-9537: libtiff: Out-of-bounds write vulnerabilities in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-09-24T00:00:00+00:00

tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.


Affected upstream versions: n/a
Fixed upstream versions: Release-v4-0-7
Upstream repository: https://github.com/vadz/libtiff
Upstream fix commit: 83a4b92815ea04969d494416eaae3d4c6b338e4a
CVE-2016-9540: libtiff: cpStripToTile heap-buffer-overflow
Component: libtiff
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-10-08T00:00:00+00:00

tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."


Affected upstream versions: n/a
Fixed upstream versions: Release-v4-0-7
Upstream repository: https://github.com/vadz/libtiff
Upstream fix commit: 5ad9d8016fbb60109302d558f7edb2cb2a3bb8e3
CVE-2016-9555: kernel: Slab out-of-bounds access in sctp_sf_ootb()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-10-25T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of the SCTP protocol. A remote attacker could trigger an out-of-bounds read with an offset of up to 64kB potentially causing the system to crash.

Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5, 6, 7, MRG-2 and realtime and will be addressed in future updates.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: bf911e985d6bbaa328c20c3e05f4eb03de11fdd6
CVE-2016-9560: jasper: stack-based buffer overflow in jpc_dec_tileinit()
Component: jasper
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-11-20T00:00:00+00:00

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 1abc2e5a401a4bf1d5ca4df91358ce5df111f495
CVE-2016-9566: nagios: Privilege escalation issue
Component: nagios
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-12-07T00:00:00+00:00

A privilege escalation flaw was found in the way Nagios handled log files. An attacker able to control the Nagios logging configuration (the 'nagios' user/group) could use this flaw to elevate their privileges to root.


Affected upstream versions: n/a
Fixed upstream versions: release-4.2.4
Upstream repository: https://github.com/NagiosEnterprises/nagioscore
Upstream fix commit: c29557dec91eba2306f5fb11b8da4474ba63f8c4
CVE-2016-9573: openjpeg: heap out-of-bounds read due to insufficient check in imagetopnm()
Component: openjpeg
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2016-11-02T00:00:00+00:00

An out-of-bounds read vulnerability was found in OpenJPEG, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.


Affected upstream versions: 2.1.2
Upstream repository: https://github.com/szukw000/openjpeg
Upstream fix commit: 7b28bd2b723df6be09fe7791eba33147c1c47d0d
CVE-2016-9576: kernel: Use after free in SCSI generic device interface
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-11-25T00:00:00+00:00

It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code which can trigger the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a0ac402cfcdc904f9772e1762b3fda112dcc56a0
CVE-2016-9583: jasper: integer overflows leading to out of bounds read in packet iterators in JPC decoder
Component: jasper
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-12-09T00:00:00+00:00

An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.


Affected upstream versions: 2.0.6
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: aa0b0f79ade5eef8b0e7a214c03f5af54b36ba7d
CVE-2016-9588: Kernel: kvm: nVMX: uncaught software exceptions in L1 guest leads to DoS
Component: Kernel
Severity: Moderate
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 3.5 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-12-14T00:00:00+00:00

Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization(nVMX) feature enabled(nested=1), is vulnerable to an uncaught exception issue. It could occur if an L2 guest was to throw an exception which is not handled by an L1 guest.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ef85b67385436ddc1998f45f1d6a210f935b3388
CVE-2016-9604: kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user
Component: kernel
Severity: Low
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Public date: 2017-04-18T00:00:00+00:00

It was discovered that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in this product.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: kernel 4.11-rc8
Fixed upstream versions: v4.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ee8f844e3c5a73b999edf733df1c529d6503ec2f
CVE-2016-9685: kernel: Memory leaks in xfs_attr_list.c error paths
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Public date: 2016-12-01T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of XFS file attributes. Two memory leaks were detected in xfs_attr_shortform_list and xfs_attr3_leaf_list_int when running a docker container backed by xfs/overlay2.  A dedicated attacker could possible exhaust all memory and create a denial of service situation.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 and 7. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 2e83b79b2d6c78bf1b4aa227938a214dcbddc83f
CVE-2016-9793: kernel: Signed overflow for SO_{SND|RCV}BUFFORCE
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-12-02T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.

Statement: This issue does not affect the kernels as shipping with Red Hat Enterprise Linux 5 and 6.  This issue does affect kernels 7, MRG-2 and realtime kernels and plans to be fixed in a future update.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b98b0bc8c431e3ceb4b26b0dfc8db509518fb290
CVE-2016-9794: kernel: ALSA: Use-after-free in kill_fasync
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-04-14T00:00:00+00:00

A use-after-free vulnerability was found in ALSA pcm layer, which allows local users to cause a denial of service, memory corruption, or possibly other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2 as the flaw was already fixed in the products listed.

Affected upstream versions: n/a
Fixed upstream versions: v4.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3aa02cb664c5fb1042958c8d1aa8c35055a2ebc4