Security Bulletin
Summary
The product includes vulnerable components (e.g., framework libraries) that may be identified and exploited with automated tools.
Vulnerability Details
CVEID: CVE-2019-15090
DESCRIPTION: Linux Kernel could allow a local attacker to obtain sensitive information, caused by an out-of-bounds read in the drivers/scsi/qedi/qedi_dbg.c. A local attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165454 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2019-15117
DESCRIPTION: Linux Kernel could allow a local attacker to obtain sensitive information, caused by an out-of-bounds memory access flaw in the parse_audio_mixer_unit function in mixer.c. By using a short descriptor, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition.
CVSS Base score: 7.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165425 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVEID: CVE-2019-15099
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c. By using an incomplete address in an endpoint descriptor, a local attacker could exploit this vulnerability to cause the system/software/application to crash.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165452 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2019-15098
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in drivers/net/wireless/ath/ath6kl/usb.c. By using an incomplete address in an endpoint descriptor, a local attacker could exploit this vulnerability to cause the system/software/application to crash.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165453 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2019-15118
DESCRIPTION: Linux Kernel is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the check_input_term function in mixer.c. By sending a specially-crafted request, a local attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/165426 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
IBM QRadar SIEM 7.4.0 to 7.4.0 Patch 2
IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 3
Remediation/Fixes
QRadar / QRM / QVM / QRIF / QNI 7.4.0 Patch 3
QRadar / QRM / QVM / QRIF / QNI 7.3.3 Patch 4
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
09 Jul 2020: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
13 July 2020
UID
ibm16246219