SB2016062712 - Integer overflow in Linux kernel core
Published: June 27, 2016
Security Bulletin ID
SB2016062712
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Integer overflow (CVE-ID: CVE-2014-9904)
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to integer overflow within the snd_compress_check_input() function in sound/core/compress_offload.c. A local user can execute arbitrary code.
Remediation
Install update from vendor's website.
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6217e5ede23285ddfee10d2e4ba0cc2d4c046205
- https://github.com/torvalds/linux/commit/6217e5ede23285ddfee10d2e4ba0cc2d4c046205
- http://www.debian.org/security/2016/dsa-3616
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html
- http://www.securityfocus.com/bid/91510
- http://www.securitytracker.com/id/1036189