kernel: pktcdvd ioctl dev_minor missing range check

Integer signedness error in the pktfinddevfromminor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service invalid pointer dereference and system crash via a crafted index value i...

Design/Logic Flaw

Array index error in the dahdi/tor2.c driver in Zaptel aka DAHDI 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check...

kernel snd_seq_oss_synth_make_info leak

The sndseqosssynthmakeinfo function in sound/core/seq/oss/seqosssynth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by maxsynthdev before returning certain data to the caller, which allows local users to obtain...

kernel security and bug fix update

2.6.18-53.1.19.0.1.el5 - NET Add entropy support to e1000 and bnx2 John Sobecki ORA 6045759 - NET Fix msi issue with kexec/kdump Michael Chan ORA 6219364 - MM Fix allocpagesnode static nid' race made kernel crash Joe Jin ORA 6187457 - splice Fix bad unlockpage in error case Jens Axboe ORA 6263574...

CVE-2008-0928

Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine...

qemu -- unchecked block read/write vulnerability

Ian Jackson reports on the debian-security mailinglist: When a block device read or write request is made by the guest, nothing checks that the request is within the range supported by the backend, but the code in the backend typically assumes that the request is sensible. Depending on the backen...

Information disclosure

LibTMCG before 1.1.1 does not perform a range check to avoid "trivial group generators," which allows attackers to obtain sensitive information about private cards...

CVE-2007-2640

LibTMCG before 1.1.1 does not perform a range check to avoid "trivial group generators," which allows attackers to obtain sensitive information about private cards...

CVE-2007-2640

Summary: CVE-2007-2640 affects LibTMCG before 1.1.1, where a missing range check to prevent trivial group generators may lead to disclosure of information about private cards. The vulnerability is classified with a CVSS v2 base score of 7.8 (HIGH) with network attack vector and no authentication ...

CVE-2007-2640

LibTMCG before 1.1.1 does not perform a range check to avoid "trivial group generators," which allows attackers to obtain sensitive information about private cards...

SUSE-SA:2005:056: XFree86-server,xorg-x11-server

The remote host is missing the patch for the advisory SUSE-SA:2005:056 XFree86-server,xorg-x11-server. The X server memory can be accessed my a malicious X client by exploiting a missing range check in the function XCreatePixmap. This bug can probably be used to execute arbitrary code with the...

CVE-2004-1777

CVE-2004-1777 describes a range-check error in Skype for Windows prior to 0.98.0.28 that can be triggered by excessively long command line arguments or a long callto:// URL, leading to a denial of service (application crash). The issue affects Skype for Windows versions before 0.98.0.28 and is di...