PT-2010-1294 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Linux RHEL 5 with Linux kernel 2.6.18 Description: The issue concerns a Red Hat configuration step for the qla2xxx driver in the Linux kernel when N Port ID Virtualization NPIV hardware is used. This configuration sets...

FreeBSD -- ZFS ZIL playback with insecure permissions

Problem Description: When replaying setattr transaction, the replay code would set the attributes with certain insecure defaults, when the logged transaction did not touch these attributes...

CentOS 5 : kernel (CESA-2009:0326)

Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

kernel: nfsv4: kernel panic in nfs4_proc_lock()

The nfs4proclock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service NULL pointer dereference and panic by sending a certain response containing incorrect file attributes, which trigger attempted use of an...

Null pointer dereference

The nfs4proclock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service NULL pointer dereference and panic by sending a certain response containing incorrect file attributes, which trigger attempted use of an...

CVE-2009-3726

The nfs4proclock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service NULL pointer dereference and panic by sending a certain response containing incorrect file attributes, which trigger attempted use of an...

kernel: md: NULL pointer deref when accessing suspend_* sysfs attributes

The md driver drivers/md/md.c in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service NULL pointer dereference via vectors related to "suspend sysfs attributes" and the 1 suspendlostore or 2 suspendhistore functions. NOTE: this is only a vulnerability when sysfs i...

MS09-062: Description of the security update for Microsoft Report Viewer 2008 Service Pack 1 Redistributable Package: October 13, 2009

None None...

Mandriva Linux Security Advisory : mono (MDVSA-2009:268)

Multiple vulnerabilities has been found and corrected in mono : Multiple cross-site scripting XSS vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to 1 HtmlControl.cs...

kernel: md: NULL pointer deref when accessing suspend_* sysfs attributes

The md driver drivers/md/md.c in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service NULL pointer dereference via vectors related to "suspend sysfs attributes" and the 1 suspendlostore or 2 suspendhistore functions. NOTE: this is only a vulnerability when sysfs i...

SuSE9 Security Update : PHP4 (YOU Patch Number 11666)

This update fixes multiple bugs in PHP : - Predictable generaton of an initialization vector IV in the mcrypt extension - Additional cookie attributes could be injected via a session ID. - Specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

freeradius security update

1.1.3-1.5 - Security: Fix Tunnel-Password zero-length attributes flaw bug 521912 Resolves: RH BZ522062 - rebase a couple of old patches freeradius-0.9.0-comerr.patch, freeradius-1.0.0-samba3.patch so they apply with fuzz=0...

CVE-2009-3111

The raddecode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service radiusd crash via zero-length Tunnel-Password attributes, as demonstrated by a certain module in VulnDisco Pack Professional 7.6 through 8.11. NOTE: this is a regression error related to...

CVE-2009-2849

The md driver drivers/md/md.c in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service NULL pointer dereference via vectors related to "suspend sysfs attributes" and the 1 suspendlostore or 2 suspendhistore functions. NOTE: this is only a vulnerability when sysfs i...

CVE-2009-2849

CVE-2009-2849 affects the Linux kernel md driver (drivers/md/md.c) prior to version 2.6.30.2. The issue allows local attackers to trigger a NULL pointer dereference in suspend_lo_store and suspend_hi_store via writable sysfs suspend_* attributes, potentially causing a denial of service. The vulne...

CVE-2009-2416

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service application crash via crafted 1 Notation or 2 Enumeration attribute types in an XML file, as demonstrated by the...

CVE-2009-2415: Undefined Security Weakness

Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows...

PT-2009-1016 · Xmlsoft +2 · Libxml +3

Name of the Vulnerable Software and Affected Versions: libxml2 versions 2.5.10 through 2.6.32 libxml version 1.8.17 Description: The issue allows context-dependent attackers to cause a denial of service, resulting in an application crash, via crafted Notation or Enumeration attribute types in an...

Buffer overflow

Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long 1 "a" HTML tag; a long src attribute in 2 embed, 3 img, or 4 script tags; 5 a long background attribute in a body tag; and...

CVE-2009-2644

Race condition in the Solaris Auditing subsystem in Sun Solaris 9 and 10 and OpenSolaris before snv121, when extended file attributes are used, allows local users to cause a denial of service panic via vectors related to "pathnames for invalid fds."...