Oval Definition:	oval:com.ubuntu.xenial:def:20162853000
Revision Date: 2016-05-02 Version: 1 Title: CVE-2016-2853 on Ubuntu 16.04 LTS (xenial) - low. Description: The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program. Family: unix Class: vulnerability Status: Reference(s): CVE-2016-2853 Platform(s): Ubuntu 16.04 LTS Product(s): Definition Synopsis Ubuntu 16.04 LTS (xenial) is installed. AND Package Information The 'linux' package in xenial is affected and needs fixing. OR The 'linux-aws' package in xenial is affected and needs fixing. OR NOT While related to the CVE in some way, the 'linux-aws-hwe' package in xenial is not affected. OR NOT While related to the CVE in some way, the 'linux-azure' package in xenial is not affected. OR NOT While related to the CVE in some way, the 'linux-azure-edge' package in xenial is not affected (note: 'imported aufs with fix'). OR While related to the CVE in some way, a decision has been made to ignore it (note: 'was needed ESM criteria'). OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned'). OR The 'linux-gcp' package in xenial is affected and needs fixing. OR While related to the CVE in some way, a decision has been made to ignore it (note: 'was needed now end-of-life'). OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned'). OR NOT While related to the CVE in some way, the 'linux-hwe' package in xenial is not affected. OR NOT While related to the CVE in some way, the 'linux-hwe-edge' package in xenial is not affected. OR The 'linux-kvm' package in xenial is affected and needs fixing. OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned'). OR NOT While related to the CVE in some way, the 'linux-oem' package in xenial is not affected. OR NOT While related to the CVE in some way, the 'linux-oracle' package in xenial is not affected. OR The vulnerability of the 'linux-raspi2' package in xenial is not known (status: 'needs-triage'). It is pending evaluation. OR The vulnerability of the 'linux-snapdragon' package in xenial is not known (status: 'needs-triage'). It is pending evaluation.
BACK