Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #80427 > unrolled thread

Bug#1051892: firmware-nonfree: CVE-2022-27635 CVE-2022-36351 CVE-2022-38076 CVE-2022-40964 CVE-2022-46329

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1051892: firmware-nonfree: CVE-2022-27635 CVE-2022-36351 CVE-2022-38076 CVE-2022-40964 CVE-2022-46329 Moritz Mühlenhoff <jmm@inutil.org> - 2023-09-13 23:20 +0200
    Bug#1051892: marked as done (firmware-nonfree: CVE-2022-27635  CVE-2022-36351 CVE-2022-38076 CVE-2022-40964 CVE-2022-46329) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-07-15 22:50 +0200

#80427 — Bug#1051892: firmware-nonfree: CVE-2022-27635 CVE-2022-36351 CVE-2022-38076 CVE-2022-40964 CVE-2022-46329

Source: firmware-nonfree
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerabilities were published for firmware-nonfree, all
fixed in linux-firmware/20230804 :

CVE-2022-27635[0]:
| Improper access control for some Intel(R) PROSet/Wireless WiFi and
| Killer(TM) WiFi software may allow a privileged user to potentially
| enable escalation of privilege via local access.

CVE-2022-36351[1]:
| Improper input validation in some Intel(R) PROSet/Wireless WiFi and
| Killer(TM) WiFi software may allow an unauthenticated user to
| potentially enable denial of service via adjacent access.

CVE-2022-38076[2]:
| Improper input validation in some Intel(R) PROSet/Wireless WiFi and
| Killer(TM) WiFi software may allow an authenticated user to
| potentially enable escalation of privilege via local access.

CVE-2022-40964[3]:
| Improper access control for some Intel(R) PROSet/Wireless WiFi and
| Killer(TM) WiFi software may allow a privileged user to potentially
| enable escalation of privilege via local access.

CVE-2022-46329[4]:
| Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi
| software may allow a privileged user to potentially enable
| escalation of privilege via local access.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-27635
    https://www.cve.org/CVERecord?id=CVE-2022-27635
[1] https://security-tracker.debian.org/tracker/CVE-2022-36351
    https://www.cve.org/CVERecord?id=CVE-2022-36351
[2] https://security-tracker.debian.org/tracker/CVE-2022-38076
    https://www.cve.org/CVERecord?id=CVE-2022-38076
[3] https://security-tracker.debian.org/tracker/CVE-2022-40964
    https://www.cve.org/CVERecord?id=CVE-2022-40964
[4] https://security-tracker.debian.org/tracker/CVE-2022-46329
    https://www.cve.org/CVERecord?id=CVE-2022-46329

Please adjust the affected versions in the BTS as needed.

[toc] | [next] | [standalone]

#82999 — Bug#1051892: marked as done (firmware-nonfree: CVE-2022-27635 CVE-2022-36351 CVE-2022-38076 CVE-2022-40964 CVE-2022-46329)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Mon, 15 Jul 2024 20:45:46 +0000
with message-id <E1sTSZu-00DUxj-1k@fasolo.debian.org>
and subject line Bug#1051892: fixed in firmware-nonfree 20240610-1
has caused the Debian Bug report #1051892,
regarding firmware-nonfree: CVE-2022-27635 CVE-2022-36351 CVE-2022-38076 CVE-2022-40964 CVE-2022-46329
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1051892: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051892
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web