CentOS Errata and Security Advisory CESA-2007:1049
The kernel packages contain the Linux kernel, the core of any Linux operating system.
A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important)
A flaw was found in the IPv4 forwarding base. This allowed a local user to cause a denial of service. (CVE-2007-2172, Important)
A flaw was found where a corrupted executable file could cause cross-region memory mappings on Itanium systems. This allowed a local user to cause a denial of service. (CVE-2006-4538, Moderate)
A flaw was found in the stack expansion when using the hugetlb kernel on PowerPC systems. This allowed a local user to cause a denial of service. (CVE-2007-3739, Moderate)
A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver that should be restricted to privileged users. (CVE-2007-4308, Moderate)
As well, these updated packages fix the following bug:
Red Hat Enterprise Linux 3 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.
Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2007-December/026517.html http://lists.centos.org/pipermail/centos-announce/2007-December/026518.html http://lists.centos.org/pipermail/centos-announce/2007-December/026524.html http://lists.centos.org/pipermail/centos-announce/2007-December/026525.html
Affected packages: kernel kernel-BOOT kernel-doc kernel-hugemem kernel-hugemem-unsupported kernel-smp kernel-smp-unsupported kernel-source kernel-unsupported
Upstream details at: https://rhn.redhat.com/errata/RHSA-2007-1049.html