Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:14157-1 Final 1 1 2019-08-29T14:18:28Z current 2019-08-29T14:18:28Z 2019-08-29T14:18:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189). - CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191). - CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023). - CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399). - CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358). - CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045). - CVE-2015-9289: A buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allowed larger values such as 23 (bsc#1143179). The following non-security bugs were fixed: - fix detection of race between fcntl-setlk and close (bsc#1140965). - ocfs2: add first lock wait time in locking_state (bsc#1134390). - ocfs2: add last unlock times in locking_state (bsc#1134390). - ocfs2: add locking filter debugfs file (bsc#1134390). - powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945,bsc#1141401,bsc#1141402,bsc#1141452,bsc#1141453,bsc#1141454). - xen-netfront: use napi_complete() correctly to prevent Rx stalling (bsc#1138744). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-kernel-source-14157,slexsp3-kernel-source-14157 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ Link for SUSE-SU-2019:14157-1 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005859.html E-Mail link for SUSE-SU-2019:14157-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1134390 SUSE Bug 1134390 https://bugzilla.suse.com/1134399 SUSE Bug 1134399 https://bugzilla.suse.com/1138744 SUSE Bug 1138744 https://bugzilla.suse.com/1139358 SUSE Bug 1139358 https://bugzilla.suse.com/1140945 SUSE Bug 1140945 https://bugzilla.suse.com/1140965 SUSE Bug 1140965 https://bugzilla.suse.com/1141401 SUSE Bug 1141401 https://bugzilla.suse.com/1141402 SUSE Bug 1141402 https://bugzilla.suse.com/1141452 SUSE Bug 1141452 https://bugzilla.suse.com/1141453 SUSE Bug 1141453 https://bugzilla.suse.com/1141454 SUSE Bug 1141454 https://bugzilla.suse.com/1142023 SUSE Bug 1142023 https://bugzilla.suse.com/1143045 SUSE Bug 1143045 https://bugzilla.suse.com/1143179 SUSE Bug 1143179 https://bugzilla.suse.com/1143189 SUSE Bug 1143189 https://bugzilla.suse.com/1143191 SUSE Bug 1143191 https://www.suse.com/security/cve/CVE-2015-9289/ SUSE CVE CVE-2015-9289 page https://www.suse.com/security/cve/CVE-2018-20855/ SUSE CVE CVE-2018-20855 page https://www.suse.com/security/cve/CVE-2019-1125/ SUSE CVE CVE-2019-1125 page https://www.suse.com/security/cve/CVE-2019-11810/ SUSE CVE CVE-2019-11810 page https://www.suse.com/security/cve/CVE-2019-13631/ SUSE CVE CVE-2019-13631 page https://www.suse.com/security/cve/CVE-2019-14283/ SUSE CVE CVE-2019-14283 page https://www.suse.com/security/cve/CVE-2019-14284/ SUSE CVE CVE-2019-14284 page SUSE Linux Enterprise Server 11 SP4-LTSS kernel-bigmem-3.0.101-108.101.1 kernel-bigmem-base-3.0.101-108.101.1 kernel-bigmem-devel-3.0.101-108.101.1 kernel-default-3.0.101-108.101.1 kernel-default-base-3.0.101-108.101.1 kernel-default-devel-3.0.101-108.101.1 kernel-default-man-3.0.101-108.101.1 kernel-ec2-3.0.101-108.101.1 kernel-ec2-base-3.0.101-108.101.1 kernel-ec2-devel-3.0.101-108.101.1 kernel-pae-3.0.101-108.101.1 kernel-pae-base-3.0.101-108.101.1 kernel-pae-devel-3.0.101-108.101.1 kernel-ppc64-3.0.101-108.101.1 kernel-ppc64-base-3.0.101-108.101.1 kernel-ppc64-devel-3.0.101-108.101.1 kernel-source-3.0.101-108.101.1 kernel-syms-3.0.101-108.101.1 kernel-trace-3.0.101-108.101.1 kernel-trace-base-3.0.101-108.101.1 kernel-trace-devel-3.0.101-108.101.1 kernel-xen-3.0.101-108.101.1 kernel-xen-base-3.0.101-108.101.1 kernel-xen-devel-3.0.101-108.101.1 kernel-bigmem-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-bigmem-base-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-bigmem-devel-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-default-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-default-base-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-default-devel-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-default-man-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-ec2-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-ec2-base-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-ec2-devel-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-pae-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-pae-base-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-pae-devel-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-ppc64-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-ppc64-base-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-ppc64-devel-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-source-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-syms-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-trace-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-trace-base-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-trace-devel-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-xen-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-xen-base-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS kernel-xen-devel-3.0.101-108.101.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23. CVE-2015-9289 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-man-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-source-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-syms-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-devel-3.0.101-108.101.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ https://www.suse.com/security/cve/CVE-2015-9289.html CVE-2015-9289 https://bugzilla.suse.com/1143179 SUSE Bug 1143179 An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace. CVE-2018-20855 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-man-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-source-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-syms-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-devel-3.0.101-108.101.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ https://www.suse.com/security/cve/CVE-2018-20855.html CVE-2018-20855 https://bugzilla.suse.com/1143045 SUSE Bug 1143045 An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073. CVE-2019-1125 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-man-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-source-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-syms-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-devel-3.0.101-108.101.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ https://www.suse.com/security/cve/CVE-2019-1125.html CVE-2019-1125 https://bugzilla.suse.com/1139358 SUSE Bug 1139358 An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free. CVE-2019-11810 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-man-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-source-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-syms-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-devel-3.0.101-108.101.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ https://www.suse.com/security/cve/CVE-2019-11810.html CVE-2019-11810 https://bugzilla.suse.com/1134399 SUSE Bug 1134399 In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages. CVE-2019-13631 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-man-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-source-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-syms-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-devel-3.0.101-108.101.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ https://www.suse.com/security/cve/CVE-2019-13631.html CVE-2019-13631 https://bugzilla.suse.com/1142023 SUSE Bug 1142023 In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. CVE-2019-14283 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-man-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-source-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-syms-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-devel-3.0.101-108.101.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ https://www.suse.com/security/cve/CVE-2019-14283.html CVE-2019-14283 https://bugzilla.suse.com/1143191 SUSE Bug 1143191 In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default. CVE-2019-14284 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-bigmem-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-default-man-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ec2-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-pae-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-ppc64-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-source-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-syms-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-trace-devel-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-base-3.0.101-108.101.1 SUSE Linux Enterprise Server 11 SP4-LTSS:kernel-xen-devel-3.0.101-108.101.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914157-1/ https://www.suse.com/security/cve/CVE-2019-14284.html CVE-2019-14284 https://bugzilla.suse.com/1143189 SUSE Bug 1143189 https://bugzilla.suse.com/1143191 SUSE Bug 1143191