{"id":"MGASA-2016-0372","summary":"Updated kernel packages fix security vulnerabilities","details":"This update is based on the upstream 4.4.30 kernel and fixes at least\nthese security issues:\n\nThe filesystem implementation in the Linux kernel through 4.8.2\npreserves the setgid bit during a setxattr call, which allows local\nusers to gain group privileges by leveraging the existence of a setgid\nprogram with restrictions on execute permissions (CVE-2016-7097).\n\nStack-based buffer overflow in the brcmf_cfg80211_start_ap function in\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux\nkernel before 4.7.5 allows local users to cause a denial of service\n(system crash) or possibly have unspecified other impact via a long SSID\nInformation Element in a command to a Netlink socket (CVE-2016-8658).\n\nThe IP stack in the Linux kernel before 4.6 allows remote attackers to\ncause a denial of service (stack consumption and panic) or possibly have\nunspecified other impact by triggering use of the GRO path for packets\nwith tunnel stacking, as demonstrated by interleaved IPv4 headers and\nGRE headers, a related issue to CVE-2016-7039 (CVE-2016-8666).\n\nThe fix for CVE-2016-7039 added in MGASA-2016-0347 has been updated to\nthe final version merged upstream.\n\nThis update also resolves a regression where amdgpu and radeon users\nwould not get any display when using displayport (upstream regression\nintroduced in 4.4.21, mga#19707)\n\nFor other upstream fixes in this update, read the referenced changelogs.\n","modified":"2026-04-16T01:49:19.342403297Z","published":"2016-11-10T14:07:23Z","upstream":["CVE-2016-7039","CVE-2016-7097","CVE-2016-8658","CVE-2016-8666"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2016-0372.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=19725"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=19707"},{"type":"ADVISORY","url":"http://advisories.mageia.org/MGASA-2016-0347.html"},{"type":"WEB","url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.27"},{"type":"WEB","url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.28"},{"type":"WEB","url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.29"},{"type":"WEB","url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.30"}],"affected":[{"package":{"name":"kernel","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/kernel?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.30-2.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2016-0372.json"}},{"package":{"name":"kernel-userspace-headers","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/kernel-userspace-headers?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.30-2.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2016-0372.json"}},{"package":{"name":"kmod-vboxadditions","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/kmod-vboxadditions?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-10.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2016-0372.json"}},{"package":{"name":"kmod-virtualbox","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/kmod-virtualbox?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-10.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2016-0372.json"}},{"package":{"name":"kmod-xtables-addons","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/kmod-xtables-addons?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-15.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2016-0372.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}