QID 671064

The kernel package contains the linux kernel (vmlinuz), the core of any linux operating system.
the kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.
security fix(es): ** disputed ** multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the lzo decompressor in the linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted literal run.
note: the author of the lzo algorithms says "the linux kernel is *not* affected; media hype.
"(cve-2014-4608) a certain backport in the tcp fast open implementation for the linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the fast open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open url when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka canonical kernel team) builds.(cve-2015-3332) an elevation of privilege vulnerability in the kernel scsi driver.
Product: android.
Versions: android kernel.
Android id a-65023233.(cve-2017-13168) an issue was discovered in drivers/i2c/i2c-core-smbus.c in the linux kernel before 4.14.15.
There is an out of bounds write in the function i2c_smbus_xfer_emulated.(cve-2017-18551) an issue was discovered in net/ipv6/ip6mr.c in the linux kernel before 4.11.
The issue can be triggered as root (e.g., inside a default lxc container or with the cap_net_admin capability) or after namespace unsharing.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

An arbitrary attacker may exploit this vulnerability to compromise the system.