CVE-2009-0746: Improper Input Validation

The makeindexeddir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain reclen field, which allows local users to cause a denial of service OOPS by attempting to mount a crafted ext4 filesystem...

CVE-2009-0745: Improper Input Validation

The ext4groupadd function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize aka resize2fs operation, which might allow local users to cause a denial of service OOPS by arranging for crafted...

Oracle Enterprise Linux 5.3 kernel security and bug fix update

2.6.18-128.el5 - cifs cifswritepages may skip unwritten pages Jeff Layton 470267 2.6.18-127.el5 - Revert: i386: check for dmidata in powernowk8 driver Prarit Bhargava 476184 - xen re-enable using xenpv in boot path for FV guests Don Dutile 473899 - xen pvhvm: guest hang on FV save/restore Don...

CVE-2009-0269: Out-of-bounds Write

fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service fault or memory corruption, or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array...

CVE-2008-4307: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the dosetlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service crash via vectors resulting in an interrupted RPC call that leads to a stray FLPOSIX lock, related to improper handling of a race between fcntl and close in th...

kernel security and bug fix update

2.6.18-92.1.22.0.1.el5 - net Add entropy support to e1000 and bnx2 John Sobecki orabug 6045759 - net Add xen pv/bonding netconsole support Tina yang orabug 6993043 bz 7258 - mm shrink zone patch John Sobecki,Chris Mason orabug 6086839 - nfs nfs attribute timeout fix Trond Myklebust orabug 7156607...

CVE-2008-4934: Improper Input Validation

The hfsplusblockallocate function in fs/hfsplus/bitmap.c in the Linux kernel before 2.6.28-rc1 does not check a certain return value from the readmappingpage function before calling kmap, which allows attackers to cause a denial of service system crash via a crafted hfsplus filesystem image...

Remote file inclusion

The dosplicefrom function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the OAPPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file...

CVE-2008-4554: Undefined Security Weakness

The dosplicefrom function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the OAPPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file...

CVE-2008-3833

CVE-2008-3833 affects the Linux kernel up to version 2.6.18 (vulnerable in 2.6.18 and earlier) where generic_file_splice_write in fs/splice.c does not properly strip setuid/setgid bits on writes via splice to a file. This allows local users to gain privileges of a different group or access sensit...

CVE-2008-3833: Undefined Security Weakness

The genericfilesplicewrite function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified...

CVE-2008-4302

CVE-2008-4302 affects the Linux kernel splice subsystem specifically fs/splice.c. The root cause is a failure in add_to_page_cache_lru, after which code attempts to unlock a page that was not locked, enabling a local user to trigger a kernel BUG and system crash (denial of service). Public adviso...

CVE-2008-4210: Undefined Security Weakness

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable...

CVE-2008-4302: Improper Locking

fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the addtopagecachelru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service kernel BUG and system crash, as...

CVE-2008-3528: Undefined Security Weakness

The error-reporting functionality in 1 fs/ext2/dir.c, 2 fs/ext3/dir.c, and possibly 3 fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service temporar...

Gentoo Security Advisory GLSA 200511-17 (FUSE)

The remote host is missing updates announced in advisory GLSA 200511-17. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200411-22 (davfs2)

The remote host is missing updates announced in advisory GLSA 200411-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

kernel security and bug fix update

2.6.18-92.1.13.0.1.el5 - NET Add entropy support to e1000 and bnx2 John Sobecki orabug 6045759 - splice Fix bad unlockpage in error case Jens Axboe orabug 6263574 - NET fix netpoll race Tina Yang orabugz 5791 2.6.18-92.1.13.el5 - md fix crashes in iteraterdev Doug Ledford 460128 455471 - sound...

Gentoo Security Advisory GLSA 200511-17 (FUSE)

The remote host is missing updates announced in advisory GLSA 200511-17. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200705-15 (samba)

The remote host is missing updates announced in advisory GLSA 200705-15. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...