Linux kernel security vulnerabilities

DoS conditions, information leakage, tuntap interface privilege escalation, bt8xx driver privilege escalation, IPv6 ICTP, UDP offload, ipip memory corruptions...

Oracle Linux 6 kernel update

2.6.32-431 - md Disabling of TRIM on RAID5 for RHEL6.5 was too aggressive Jes Sorensen 1028426 2.6.32-430 - x86 Revert 'efi: be more paranoid about available space when creating variables' Rafael Aquini 1012370 1023173 - x86 Revert 'efivars: firmware bug workarounds should be in platform code'...

SuSE 11.2 Security Update : Linux Kernel (SAT Patch Numbers 8509 / 8516 / 8518)

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to version 3.0.101 and also includes various other bug and security fixes. The following features have been added : - Drivers: hv: Support handling multiple VMBUS versions FATE314665. - Drivers: hv: Save and export negotiated vmbus...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux 6 kernel update

Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 6. This is the fifth regular update. The Red Hat Security Response Team has...

CVE-2013-4563

The udp6ufofragment function in net/ipv6/udpoffload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload UFO is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service panic via a lar...

CVE-2013-4563

The udp6ufofragment function in net/ipv6/udpoffload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload UFO is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service panic via a lar...

Design/Logic Flaw

The udp6ufofragment function in net/ipv6/udpoffload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload UFO is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service panic via a lar...

[Tundeep v0.2a] Layer 2 VPN/Injection tool

Tundeep is a layer 2 VPN/injection tool that resides almost entirely in user space on the victim aside from the pcap requirement. This can be handled via a silent install however. The tool will build on Linux and Windows victims. Windows compilation is achieved using Cygwin. The attacker must be ...

CVE-2013-4563

The udp6ufofragment function in net/ipv6/udpoffload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload UFO is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service panic via a lar...

CVE-2013-4563

The udp6ufofragment function in net/ipv6/udpoffload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload UFO is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service panic via a lar...

CVE-2013-4563

The udp6ufofragment function in net/ipv6/udpoffload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload UFO is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service panic via a lar...

CVE-2013-3694

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

Cross site request forgery (csrf)

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

CVE-2013-6798

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in certain situations involving successive logins with different accounts, which allows context-dependent attackers to bypass intended...

Design/Logic Flaw

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in certain situations involving successive logins with different accounts, which allows context-dependent attackers to bypass intended...

CVE-2013-6798

BlackBerry Link before 1.2.1.31 (Windows) and before 1.1.1 build 39 (Mac) is affected by two vulnerabilities: CVE-2013-3694 lets remote attackers read or create arbitrary files via IPv6 WebDAV without authentication; CVE-2013-6798 allows context-dependent attackers to bypass access restrictions o...

CVE-2013-6798

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in certain situations involving successive logins with different accounts, which allows context-dependent attackers to bypass intended...

CVE-2013-3694

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

CVE-2013-3694

BlackBerry Link is affected by CVE-2013-3694 and related CVE-2013-6798. The vulnerable components are the WebDAV-enabled remote file-access folders in BlackBerry Link prior to Windows 1.2.1.31 and Mac OS X 1.1.1 build 39. The root cause is improper authentication for remote WebDAV access over IPv...

Kernel: net: panic while pushing pending data out of a IPv6 socket with UDP_CORK enabled

The udpv6pushpendingframes function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service BUG and system crash via a crafted application that uses the UDPCORK option ...