The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2665-1 advisory.

  - Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows     local users to bypass intended size restrictions and trigger read operations on additional memory     locations by changing the handle_bytes value of a file handle during the execution of this function.
    (CVE-2015-1420)

  - Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the     OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service     (system crash) or possibly execute arbitrary code via a crafted packet. (CVE-2015-4001)

  - drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure     that certain length values are sufficiently large, which allows remote attackers to cause a denial of     service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to     the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions. (CVE-2015-4002)

  - The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux     kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system     crash) via a crafted packet. (CVE-2015-4003)

  - Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x     before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via     O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. (CVE-2015-5706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2664-1 advisory.

  - Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows     local users to bypass intended size restrictions and trigger read operations on additional memory     locations by changing the handle_bytes value of a file handle during the execution of this function.
    (CVE-2015-1420)

  - Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the     OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service     (system crash) or possibly execute arbitrary code via a crafted packet. (CVE-2015-4001)

  - drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure     that certain length values are sufficiently large, which allows remote attackers to cause a denial of     service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to     the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions. (CVE-2015-4002)

  - The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux     kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system     crash) via a crafted packet. (CVE-2015-4003)

  - The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain     length values, which allows local users to cause a denial of service (incorrect data representation or     integer overflow, and OOPS) via a crafted UDF filesystem. (CVE-2015-4167)

  - The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows     local users to cause a denial of service (system crash) by creating a packet filter and then loading     crafted BPF instructions that trigger late convergence by the JIT compiler. (CVE-2015-4700)

  - Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x     before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via     O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. (CVE-2015-5706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak.

  - CVE-2015-1333     Colin Ian King discovered a flaw in the add_key function     of the Linux kernel's keyring subsystem. A local user     can exploit this flaw to cause a denial of service due     to memory exhaustion.

  - CVE-2015-3212     Ji Jianwen of Red Hat Engineering discovered a flaw in     the handling of the SCTPs automatic handling of dynamic     multi-homed connections. A local attacker could use this     flaw to cause a crash or potentially for privilege     escalation.

  - CVE-2015-4692     A NULL pointer dereference flaw was found in the     kvm_apic_has_events function in the KVM subsystem. A     unprivileged local user could exploit this flaw to crash     the system kernel resulting in denial of service.

  - CVE-2015-4700     Daniel Borkmann discovered a flaw in the Linux kernel     implementation of the Berkeley Packet Filter which can     be used by a local user to crash the system.

  - CVE-2015-5364     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     could exploit this flaw to cause a denial of service     using a flood of UDP packets with invalid checksums.

  - CVE-2015-5366     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     can cause a denial of service against applications that     use epoll by injecting a single packet with an invalid     checksum.

  - CVE-2015-5697     A flaw was discovered in the md driver in the Linux     kernel leading to an information leak.

  - CVE-2015-5706     An user triggerable use-after-free vulnerability in path     lookup in the Linux kernel could potentially lead to     privilege escalation.

  - CVE-2015-5707     An integer overflow in the SCSI generic driver in the     Linux kernel was discovered. A local user with write     permission on a SCSI generic device could potentially     exploit this flaw for privilege escalation.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2681-1 advisory.

  - The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not     properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls,     which allows local users to cause a denial of service (system crash) or possibly gain privileges via a     crafted application, aka an I/O vector array overrun. (CVE-2015-1805)

  - The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by leveraging /dev/kvm access for an ioctl call. (CVE-2015-4692)

  - The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows     local users to cause a denial of service (system crash) by creating a packet filter and then loading     crafted BPF instructions that trigger late convergence by the JIT compiler. (CVE-2015-4700)

  - The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly     consider yielding a processor, which allows remote attackers to cause a denial of service (system hang)     via incorrect checksums within a UDP packet flood. (CVE-2015-5364)

  - The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate
    -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll     application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than     CVE-2015-5364. (CVE-2015-5366)

  - Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x     before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via     O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. (CVE-2015-5706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
84616	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2665-1)	Nessus	Ubuntu Local Security Checks	7/8/2015	1/9/2024	medium
84615	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2664-1)	Nessus	Ubuntu Local Security Checks	7/8/2015	1/9/2024	medium
85281	Debian DSA-3329-1 : linux - security update	Nessus	Debian Local Security Checks	8/10/2015	1/11/2021	high
84982	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2681-1)	Nessus	Ubuntu Local Security Checks	7/24/2015	1/9/2024	high

Detections

Analytics

Plugins Search

medium

medium

high

high