linux-2.6 - several vulnerabilities

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a denial of service, or privilege escalation. The Common
Vulnerabilities and Exposures project identifies the following
problems:

• CVE-2009-1895
  Julien Tinnes and Tavis Ormandy reported an issue in the Linux
  personality code. Local users can take advantage of a setuid
  binary that can either be made to dereference a NULL pointer or
  drop privileges and return control to the user. This allows a
  user to bypass mmap_min_addr restrictions which can be exploited
  to execute arbitrary code.
• CVE-2009-2287
  Matt T. Yourst discovered an issue in the kvm subsystem. Local
  users with permission to manipulate /dev/kvm can cause a denial
  of service (hang) by providing an invalid cr3 value to the
  KVM_SET_SREGS call.
• CVE-2009-2406
  CVE-2009-2407
  Ramon de Carvalho Valle discovered two issues with the eCryptfs
  layered filesystem using the fsfuzzer utility. A local user with
  permissions to perform an eCryptfs mount may modify the contents
  of a eCryptfs file, overflowing the stack and potentially gaining
  elevated privileges.

For the stable distribution (lenny), these problems have been fixed in
version 2.6.26-17lenny1.

For the oldstable distribution (etch), these problems, where
applicable, will be fixed in updates to linux-2.6 and linux-2.6.24.

We recommend that you upgrade your linux-2.6 and user-mode-linux
packages.

Note: Debian carefully tracks all known security issues across every
linux kernel package in all releases under active security support.
However, given the high frequency at which low-severity security
issues are discovered in the kernel and the resource requirements of
doing an update, updates for lower priority issues will normally not
be released for all kernels at the same time. Rather, they will be
released in a staggered or “leap-frog” fashion.