7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.1 Low
EPSS
Percentile
94.0%
Notice: Debian 5.0.4, the next point release of Debian ‘lenny’,
will include a new default value for the mmap_min_addr tunable.
This change will add an additional safeguard against a class of security
vulnerabilities known as “NULL pointer dereference” vulnerabilities, but
it will need to be overridden when using certain applications.
Additional information about this change, including instructions for
making this change locally in advance of 5.0.4 (recommended), can be
found at: <https://wiki.debian.org/mmap_min_addr>.
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a denial of service, sensitive memory leak or privilege escalation.
The Common Vulnerabilities and Exposures project identifies the following
problems:
For the oldstable distribution (etch), these problems, where
applicable, will be fixed in updates to linux-2.6 and linux-2.6.24.
For the stable distribution (lenny), this problem has been fixed in
version 2.6.26-19lenny1.
We recommend that you upgrade your linux-2.6 and user-mode-linux
packages.
Note: Debian carefully tracks all known security issues across every
linux kernel package in all releases under active security support.
However, given the high frequency at which low-severity security
issues are discovered in the kernel and the resource requirements of
doing an update, updates for lower priority issues will normally not
be released for all kernels at the same time. Rather, they will be
released in a staggered or “leap-frog” fashion.
The following matrix lists additional source packages that were rebuilt for
compatibility with or to take advantage of this update:
Debian 5.0 (lenny) | |
---|---|
user-mode-linux | 2.6.26-1um-2+19lenny1 |