Bugtraq: [SECURITY] [DSA 1436-1] New Linux 2.6.18 packages fix several vulnerabilities
[SECURITY] [DSA 1436-1] New Linux 2.6.18 packages fix several vulnerabilities
From: dann frazier <dannf_at_debian.org>
Date: Thu, 20 Dec 2007 15:28:26 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1436-1 security_at_debian.org
http://www.debian.org/security/ dann frazier
December 20th, 2007 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : linux-2.6
Vulnerability : several
Problem-Type : local
Debian-specific: no
CVE ID : CVE-2006-6058 CVE-2007-5966 CVE-2007-6063 CVE-2007-6206
CVE-2007-6417
Several local vulnerabilities have been discovered in the Linux kernel
that may lead to a denial of service or the execution of arbitrary
code. The Common Vulnerabilities and Exposures project identifies the
following problems:
CVE-2006-6058
LMH reported an issue in the minix filesystem that allows local users
with mount privileges to create a DoS (printk flood) by mounting a
specially crafted corrupt filesystem.
CVE-2007-5966
Warren Togami discovered an issue in the hrtimer subsystem that allows
a local user to cause a DoS (soft lockup) by requesting a timer sleep
for a long period of time leading to an integer overflow.
CVE-2007-6063
Venustech AD-LAB discovered a a buffer overflow in the isdn ioctl
handling, exploitable by a local user.
CVE-2007-6206
Blake Frantz discovered that when a core file owned by a non-root user
exists, and a root-owned process dumps core over it, the core file
retains its original ownership. This could be used by a local user to
gain access to sensitive information.
CVE-2007-6417
Hugh Dickins discovered an issue in the tmpfs filesystem where, under
a rare circumstance, a kernel page maybe improperly cleared, leaking
sensitive kernel memory to userspace or resulting in a DoS (crash).
These problems have been fixed in the stable distribution in version
2.6.18.dfsg.1-13etch6.
The following matrix lists additional packages that were rebuilt for
compatability with or to take advantage of this update:
We recommend that you upgrade your kernel package immediately and reboot
the machine. If you have built a custom kernel from the kernel source
package, you will need to rebuild to take advantage of these fixes.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- --------------------------------
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ etch/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/etch/updates/main
Mailing list: debian-security-announce_at_lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHauv9huANDBmkLRkRAp/9AJ9mq2cgvUDVjCqEnc2wemdRx++ExQCdFETo
39yIA+nEQCCq6inZrbrQSHQ=
=rj9S
-----END PGP SIGNATURE-----
Received on Dec 20 2007
