SB2015120324 - Ubuntu update for linux

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015120324

SB2015120324 - Ubuntu update for linux

Published: December 3, 2015 Updated: October 31, 2026

Security Bulletin ID SB2015120324
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Information exposure (CVE-ID: CVE-2013-4299)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read and manipulate data.

The vulnerability exists due to information exposure error within the area_location(), read_exceptions() and persistent_prepare_exception() functions in drivers/md/dm-snap-persistent.c. A remote user can read and manipulate data.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-4470)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.


Remediation

Install update from vendor's website.

References