MGASA-2017-0149

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2017-0149.html
Import Source
https://advisories.mageia.org/MGASA-2017-0149.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2017-0149
Related
Published
2017-05-26T06:54:58Z
Modified
2022-02-17T18:21:47Z
Summary
Updated kernel packages fixes security vulnerabilities
Details

This kernel update is based on upstream 4.4.68 and fixes at least the following security issues:

The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (CVE-2017-7645).

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c (CVE-2017-7895).

For other upstream fixes in this update, see the referenced changelogs.

References
Credits

Affected packages