SUSE-SU-2019:1924-1

    Dashboard / Vulnerabilities / SUSE-SU-2019:1924-1

    SUSE-SU-2019:1924-1

    Published: 23 Jul 2019Last Modified: 4 Feb 2026

    Summary: Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP1)

    Details: This update for the Linux Kernel 3.12.74-60_64_110 fixes several issues. The following security issues were fixed: - CVE-2019-11477: Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. (bsc#1137586) - CVE-2019-11478: Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (bsc#1137586) This update contains a regression fix for CVE-2019-11477 and CVE-2019-11478 (bsc#1140747).

    References: https://www.suse.com/support/update/announcement/2019/suse-su-20191924-1/, https://bugzilla.suse.com/1137597, https://bugzilla.suse.com/1140747, https://www.suse.com/security/cve/CVE-2019-11477, https://www.suse.com/security/cve/CVE-2019-11478

    Affected packages

    Package

    Name: kgraft-patch-SLE12-SP1_Update_30

    Purl: pkg:rpm/suse/kgraft-patch-SLE12-SP1_Update_30&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -10-2.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High