PT-2017-6844 · Linux · Linux Kernel

Adam Mariš · Published 2016-06-13 · Updated 2019-03-07 · CVE-2015-5327

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernels versions 4.3-rc1 and later

Description The issue is related to an out-of-bounds memory read in the x509 decode time function, located in the x509 cert parser.c file. This problem affects Linux kernels.

Recommendations For Linux kernels versions 4.3-rc1 and later, consider applying a patch to fix the out-of-bounds memory read issue in the x509 decode time function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2015-5327

MGASA-2016-0225

MGASA-2016-0232

MGASA-2016-0233

Affected Products

Linux Kernel

References · 34

• https://linux.oracle.com/errata/ELSA-2019-4642.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0232 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5327 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0225 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5327 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0233 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc25b994acfbc901429da682d0f73c190e960206 · Patch
• https://advisories.mageia.org/MGASA-2016-0233.html · Security Note
• https://advisories.mageia.org/MGASA-2016-0232.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-5327 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5327 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0225.html · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=18688 · Note
• http://kernelnewbies.org/Linux_4.2 · Note
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1 · Note