mend-for-github-com[bot]
commented
1 year ago :information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #47
Closed mend-for-github-com[bot] closed 1 year ago
mend-for-github-com[bot]
commented
1 year ago :information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #47
mend-for-github-com[bot]
commented
1 year ago :information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #47
Library home page: https://sourceforge.net/projects/dlink/
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Vulnerabilities
Details
CVE-2016-10150
### Vulnerable Library - dlinkDIR895LA1_GPL100b11Library home page: https://sourceforge.net/projects/dlink/
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (1)
/release/src-rt-7.14.114.x/src/linux/linux-2.6.36/virt/kvm/kvm_main.c
### Vulnerability DetailsUse-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
Publish Date: 2017-02-06
URL: CVE-2016-10150
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10150
Release Date: 2017-02-06
Fix Resolution: 4.8.13
CVE-2019-14821
### Vulnerable Library - dlinkDIR895LA1_GPL100b11Library home page: https://sourceforge.net/projects/dlink/
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)
/release/src-rt-7.14.114.x/src/linux/linux-2.6.36/virt/kvm/coalesced_mmio.c
/release/src-rt-7.14.114.x/src/linux/linux-2.6.36/virt/kvm/coalesced_mmio.c
/release/src-rt-7.14.114.x/src/linux/linux-2.6.36/virt/kvm/coalesced_mmio.c
### Vulnerability DetailsAn out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.
Publish Date: 2019-09-19
URL: CVE-2019-14821
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14821
Release Date: 2019-09-19
Fix Resolution: v5.4-rc1
CVE-2021-4093
### Vulnerable Library - dlinkDIR895LA1_GPL100b11Library home page: https://sourceforge.net/projects/dlink/
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (1)
### Vulnerability DetailsA flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.
Publish Date: 2022-02-18
URL: CVE-2021-4093
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.linuxkernelcves.com/cves/CVE-2021-4093
Release Date: 2022-02-18
Fix Resolution: v5.14.15,v5.15-rc7
CVE-2014-7822
### Vulnerable Libraries - dlinkDIR895LA1_GPL100b11, dlinkDIR895LA1_GPL100b11, dlinkDIR895LA1_GPL100b11, dlinkDIR895LA1_GPL100b11
### Vulnerability DetailsThe implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.
Publish Date: 2015-03-16
URL: CVE-2014-7822
### CVSS 3 Score Details (8.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.linuxkernelcves.com/cves/CVE-2014-7822
Release Date: 2015-03-16
Fix Resolution: v3.16-rc1,v3.12.39,v3.14.47,v3.2.67
CVE-2011-0712
### Vulnerable Libraries - dlinkDIR895LA1_GPL100b11, dlinkDIR895LA1_GPL100b11
### Vulnerability DetailsMultiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.
Publish Date: 2011-02-18
URL: CVE-2011-0712
### CVSS 3 Score Details (8.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-0712
Release Date: 2011-02-18
Fix Resolution: 2.6.38-rc4-next-20110215
CVE-2011-1013
### Vulnerable Library - dlinkDIR895LA1_GPL100b11Library home page: https://sourceforge.net/projects/dlink/
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (1)
/release/src-rt-7.14.114.x/src/linux/linux-2.6.36/include/drm/drmP.h
### Vulnerability DetailsInteger signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.
Publish Date: 2011-05-09
URL: CVE-2011-1013
### CVSS 3 Score Details (8.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-1013
Release Date: 2011-05-09
Fix Resolution: Linux kernel - 2.6.38,OpenBSD - 4.9