Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056).

Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges. (CVE-2007-0005)

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958).

The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference. (CVE-2007-1000)

Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet. (CVE-2007-1217)

The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux kernel 2.6.17, and possibly other versions, allows local users to cause a denial of service (oops) by calling setsockopt with the IPV6_RTHDR option name and possibly a zero option length or invalid option value, which triggers a NULL pointer dereference.
(CVE-2007-1388)

net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double-free by opening a listeing IPv6 socket, attaching a flow label, and connecting to that socket. (CVE-2007-1592)

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - Suspend to disk speed improvements

    - Add nmi watchdog support for core2

    - Add atl1 driver

    - Update KVM

    - Add acer_acpi

    - Update asus_acpi

    - Fix suspend on r8169, i8259A

    - Fix suspend when using ondemand governor

    - Add ide acpi support

    - Add suspend/resume support for sata_nv chipsets.

    - USB: Let USB-Serial option driver handle anydata       devices (#29066)

    - USB: Add PlayStation 2 Trance Vibrator driver

    - Fix bogus delay loop in video/aty/mach64_ct.c

    - Add MCP61 support (#29398)

    - USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8       times bug

    - Improve keyboard handling on Apple MacBooks

    - Add -latest patch

    - Workaround a possible binutils bug in smp alternatives

    - Add forcedeth support

    - Fix potential deadlock in driver core (USB hangs at       boot time #24683)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

リモートの Oracle Linux 5 ホストに、ELSA-2007-0347 のアドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    [2.6.18-8.1.4.0.1.el5]
     - 適切なネットワークを選択するように primary=ethX の結合を修正Bert Barbe 氏[IT 101532] [ORA 5136660]
     - e1000 にエントロピーモジュールオプションを追加John Sobecki 氏[ORA 6045759]
     - エントロピーモジュールオプションを bnx2 に追加John Sobecki 氏[ORA 6045759]

     [2.6.18.8.1.4.el5]
     - [ipv6] ルーティングの回帰を修正します。David S. Miller 氏 [238046]
     - [mm] Gdb がバックトレースを正確に出力しません。Dave Anderson 氏 [235511]
     - [NMI] ウォッチドッグタイムアウトを 30 秒に変更しますLarry Woodman 氏 [237655]
     - [dlm] モードマンジングを修正しますDavid Tegland 氏 [238731]
     - [net] kernel-headerstypes.h の欠落したインクルードNeil Horman 氏 [238749]
     - [net] fib_semantics.c の領域外チェックThomas Graf 氏 [238948] {CVE-2007-2172}
     - [net] デフォルトで RH0 を許可しませんThomas Graf 氏 [238949] {CVE-2007-2242}
     - [net] FIB netlink でのユーザー OOPS 可能なバグを修正David S. Miller 氏 [238960] {CVE-2007-1861}
     - [net] nf_conntrack netfilter コードをバイパスする IPv6 フラグメントThomas Graf 氏 [238947] {CVE-2007-1497}
     - [net] ipv6_fl_socklist は不注意により共有されていますDavid S. Miller 氏 [238944] {CVE-2007-1592}
     - [net] netfilter コードでのさまざまな NULL ポインターデリファレンスThomas Graf 氏 [238946] {CVE-2007-1496}

     [2.6.18-8.1.3.el5]
     - [s390] page_mkclean により、s390 でデータ破損が発生しますJan Glauber 氏 [236605]

     [2.6.18-8.1.2.el5]
     - [utrace] 悪用および kill できない cpu の修正Roland McGrath 氏 [228816]CVE-2007-0771]
     - [net] ipv6_sockglue.c の IPv6 セキュリティホール - 2David S. Miller 氏 [232257] {CVE-2007-1000}
     - [net] ipv6_sockglue.c の IPv6 セキュリティホールDavid S. Miller 氏 [232255] {CVE-2007-1388}
     - [audit] ノンブロッキングコンテキストの GFP_KERNEL 割り当てを修正Alexander Viro 氏 [233157]

     [2.6.18-8.1.1.el5]
     - [cpufreq] tscsync から __initdata を削除Prait Bhargava 氏 [229887]
     - [セキュリティ] キーのシリアル番号衝突の問題を修正しますDavid Howells 氏 [229883] {CVE-2007-0006}
     - [fs] 読み取り専用バイナリをコアダンプしませんDon Howard 氏 [229885] {CVE-2007-0958}
     - [xen] > 64G のマシンで起動を有効にしますChris Lalancette 氏 [230117]
     - cardman 4040 cmx ドライバーの潜在的なバッファオーバーフローを修正しますDon Howard 氏 [229884] {CVE-2007-0005}

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the Omnikey CardMan 4040 driver that allowed a local user to execute arbitrary code with kernel privileges. In order to exploit this issue, the Omnikey CardMan 4040 PCMCIA card must be present and the local user must have access rights to the character device created by the driver. (CVE-2007-0005, Moderate)

* a flaw in the core-dump handling that allowed a local user to create core dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low)

In addition to the security issues described above, a fix for a kernel panic in the powernow-k8 module, and a fix for a kernel panic when booting the Xen domain-0 on system with large memory installations have been included.

Red Hat would like to thank Daniel Roethlisberger for reporting an issue fixed in this erratum.

Red Hat Enterprise Linux 5 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0347 advisory.

    [2.6.18-8.1.4.0.1.el5]
     -Fix bonding primary=ethX so it picks correct network (Bert Barbe) [IT      101532] [ORA 5136660]
     -Add entropy module option to e1000 (John Sobecki) [ORA 6045759]
     -Add entropy module option to bnx2 (John Sobecki) [ORA 6045759]

     [2.6.18.8.1.4.el5]
     - [ipv6] Fix routing regression. (David S. Miller ) [238046]
     - [mm] Gdb does not accurately output the backtrace. (Dave Anderson )      [235511]
     - [NMI] change watchdog timeout to 30 seconds (Larry Woodman ) [237655]
     - [dlm] fix mode munging (David Teigland ) [238731]
     - [net] kernel-headers: missing include of types.h (Neil Horman ) [238749]
     - [net] fib_semantics.c out of bounds check (Thomas Graf ) [238948]      {CVE-2007-2172}
     - [net] disallow RH0 by default (Thomas Graf ) [238949] {CVE-2007-2242}
     - [net] Fix user OOPS'able bug in FIB netlink (David S. Miller )      [238960] {CVE-2007-1861}
     - [net] IPv6 fragments bypass in nf_conntrack netfilter code (Thomas      Graf ) [238947] {CVE-2007-1497}
     - [net] ipv6_fl_socklist is inadvertently shared (David S. Miller )      [238944] {CVE-2007-1592}
     - [net] Various NULL pointer dereferences in netfilter code (Thomas Graf      ) [238946] {CVE-2007-1496}

     [2.6.18-8.1.3.el5]
     - [s390] page_mkclean causes data corruption on s390 (Jan Glauber ) [236605]

     [2.6.18-8.1.2.el5]
     - [utrace] exploit and unkillable cpu fixes (Roland McGrath ) [228816]      (CVE-2007-0771)
     - [net] IPV6 security holes in ipv6_sockglue.c - 2 (David S. Miller )      [232257] {CVE-2007-1000}
     - [net] IPV6 security holes in ipv6_sockglue.c (David S. Miller )      [232255] {CVE-2007-1388}
     - [audit] GFP_KERNEL allocations in non-blocking context fix (Alexander      Viro ) [233157]

     [2.6.18-8.1.1.el5]
     - [cpufreq] Remove __initdata from tscsync (Prarit Bhargava ) [229887]
     - [security] Fix key serial number collision problem (David Howells )      [229883] {CVE-2007-0006}
     - [fs] Don't core dump read-only binarys (Don Howard ) [229885]      {CVE-2007-0958}
     - [xen] Enable booting on machines with > 64G (Chris Lalancette) [230117]
     - Fix potential buffer overflow in cardman 4040 cmx driver (Don Howard)      [229884] {CVE-2007-0005}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Rebased to kernel 2.6.20.3-rc1 :

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.1 (The CVE fix in 2.6.20.1 is already in kernel-2.6.19-1.2911.6.5.fc6.) http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.2 Changelog for 2.6.20.3 is not available yet.

This release does not include Xen kernels.

CVE-2007-0005: A vulnerability has been reported in the Linux Kernel, which potentially can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

The vulnerability is caused due to boundary errors within the 'read()' and 'write()' functions of the Omnikey CardMan 4040 driver. This can be exploited to cause a buffer overflow and may allow the execution of arbitrary code with kernel privileges.

CVE-2007-1000: A vulnerability has been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or disclose potentially sensitive information.

The vulnerability is due to a NULL pointer dereference within the 'ipv6_getsockopt_sticky()' function in net/ipv6/ipv6_sockglue.c. This can be exploited to crash the kernel or disclose kernel memory.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The compat_sys_mount function allowed local users to cause a denial of service when mounting a smbfs filesystem in compatibility mode.
(CVE-2006-7203)

The Omnikey CardMan 4040 driver (cm4040_cs) did not limit the size of buffers passed to read() and write(). A local attacker could exploit this to execute arbitrary code with kernel privileges. (CVE-2007-0005)

Due to a variable handling flaw in the ipv6_getsockopt_sticky() function a local attacker could exploit the getsockopt() calls to read arbitrary kernel memory. This could disclose sensitive data.
(CVE-2007-1000)

Ilja van Sprundel discovered that Bluetooth setsockopt calls could leak kernel memory contents via an uninitialized stack buffer. A local attacker could exploit this flaw to view sensitive kernel information.
(CVE-2007-1353)

A flaw was discovered in the handling of netlink messages. Local attackers could cause infinite recursion leading to a denial of service. (CVE-2007-1861)

A flaw was discovered in the IPv6 stack's handling of type 0 route headers. By sending a specially crafted IPv6 packet, a remote attacker could cause a denial of service between two IPv6 hosts.
(CVE-2007-2242)

The random number generator was hashing a subset of the available entropy, leading to slightly less random numbers. Additionally, systems without an entropy source would be seeded with the same inputs at boot time, leading to a repeatable series of random numbers.
(CVE-2007-2453)

A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. (CVE-2007-2525)

An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel memory using large file offsets while reading the tasks file. This could disclose sensitive data. (CVE-2007-2875)

Vilmos Nebehaj discovered that the SCTP netfilter code did not correctly validate certain states. A remote attacker could send a specially crafted packet causing a denial of service. (CVE-2007-2876)

Luca Tettamanti discovered a flaw in the VFAT compat ioctls on 64-bit systems. A local attacker could corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

遠端 Oracle Linux 5 主機中安裝的套件受到 ELSA-2007-0347 公告中提及的多個弱點影響。

    [2.6.18-8.1.4.0.1.el5]
     - 修正連結 primary=ethX使其能夠挑選正確的網路 (Bert Barbe) [IT 101532] [ORA 5136660]
     - 將 entropy 模組選項新增至 e1000 (John Sobecki) [ORA 6045759]
     - 新增熵模組選項至 bnx2 (John Sobecki) [ORA 6045759]

     [2.6.18.8.1.4.el5]
     - [ipv6] 修正路由回歸。(David S. Miller) [238046]
     - [mm] Gdb 未正確輸出反向追踪。(Dave Anderson) [235511]
     - [NMI] 將看門狗逾時變更為 30 秒 (Larry Woodman ) [237655]
     - [dlm] 修正 munging 模式 (David Teigland ) [238731]
     - [net] kernel-headers缺少 types.h 的包含 (Neil Horman ) [238749]
     - [net] fib_semantics.c 超出邊界檢查 (Thomas Graf ) [238948] {CVE-2007-2172}
     - [net] 依預設不允許 RH0 (Thomas Graf ) [238949] {CVE-2007-2242}
     - [net] 修正使用者在 FIB netlink 中可發生 OOPS 的錯誤 (David S. Miller ) [238960] {CVE-2007-1861}
     - [net] nf_conntrack netfilter 程式碼中的 IPv6 片段繞過 (Thomas Graf ) [238947] {CVE-2007-1497}
     - [net] ipv6_fl_socklist 意外遭到共用 (David S. Miller ) [238944] {CVE-2007-1592}
     - [net] netfilter 程式碼中的各種 NULL 指標解除參照 (Thomas Graf) [238946] {CVE-2007-1496}

     [2.6.18-8.1.3.el5]
     - [s390] page_mkclean 造成 s390 資料損毀 (Jan Glauber ) [236605]

     [2.6.18-8.1.2.el5]
     - [utrace] 惡意利用和無法終止的 cpu 修正 (Roland McGrath ) [228816] (CVE-2007-0771)
     - [net] ipv6_sockglue.c 中的 IPV6 安全性漏洞 - 2 (David S. Miller ) [232257] {CVE-2007-1000}
     - [net] ipv6_sockglue.c 中的 IPV6 安全性漏洞 (David S. Miller ) [232255] {CVE-2007-1388}
     - [audit] 非封鎖內容修正中的 GFP_KERNEL 配置 (Alexander Viro ) [233157]

     [2.6.18-8.1.1.el5]
     - [cpufreq] 從 tscsync 移除 __initdata (Prarit Bhargava ) [229887]
     - [安全性] 修正金鑰序號衝突問題 (David Howells ) [229883] {CVE-2007-0006}
     - [fs] 不核心轉儲存唯讀二進位 (Don Howard ) [229885] {CVE-2007-0958}
     - [xen] 在大於 64G 的機器上啟用開機 (Chris Lalancette) [230117]
     - 修正 cardman 4040 cmx 驅動程式中潛在的緩衝區溢位 (Don Howard) [229884] {CVE-2007-0005}

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Oracle Linux 5 主机上安装的程序包受到 ELSA-2007-0347 公告中提及的多个漏洞的影响。

    [2.6.18-8.1.4.0.1.el5]
     - 修复绑定primary=ethX使其选择正确的网络 (Bert Barbe) [IT 101532] [ORA 5136660]
     -向 e1000 添加熵模块选项 (John Sobecki) [ORA 6045759]
     -将熵模块选项添加至 bnx2 (John Sobecki) [ORA 6045759]

     [2.6.18.8.1.4.el5]
     - [ipv6] 修复路由回归。(David S. Miller) [238046]
     - [mm] Gdb 未准确输出回溯。Dave Anderson [235511]
     - [NMI] 将监视程序超时更改为 30 秒 (Larry Woodman ) [237655]
     - [dlm] 修复模式修改 (David Teigland ) [238731]
     - [net] kernel-headers缺少 types.h 的包含 (Neil Horman ) [238749]
     - [net] fib_semantics.c 越界检查 (Thomas Graf ) [238948] {CVE-2007-2172}
     - [net] 默认情况下禁止 RH0 (Thomas Graf ) [238949] {CVE-2007-2242}
     - [net] 修复 FIB netlink 中可发生用户 OOPS 的缺陷 (David S. Miller ) [238960] {CVE-2007-1861}
     - [net] nf_conntrack netfilter 代码中的 IPv6 碎片绕过 (Thomas Graf ) [238947] {CVE-2007-1497}
     - [net] ipv6_fl_socklist 无意中共享 (David S. Miller ) [238944] {CVE-2007-1592}
     - [net] netfilter 代码中的各种空指针取消引用 (Thomas Graf) [238946] {CVE-2007-1496}

     [2.6.18-8.1.3.el5]
     - [s390] page_mkclean 在 s390 上造成数据损坏 (Jan Glauber ) [236605]

     [2.6.18-8.1.2.el5]
     - [utrace] 利用和无法终止的 cpu 补丁 (Roland McGath ) [228816] (CVE-2007-0771)
     - [net] ipv6_sockglue.c 中的 IPV6 安全漏洞 - 2 (David S. Miller ) [232257] {CVE-2007-1000}
     - [net] ipv6_sockglue.c 中的 IPV6 安全漏洞 (David S. Miller ) [232255] {CVE-2007-1388}
     - [审计] 非阻塞上下文中的 GFP_KERNEL 分配修复 (Alexander Viro ) [233157]

     [2.6.18-8.1.1.el5]
     - [cpufreq] 从 tscsync 中删除 __initdata (Prarit Bhargava ) [229887]
     - [安全] 修复密钥序列号冲突问题 (David Howells ) [229883] {CVE-2007-0006}
     - [fs] 不要核心转储只读二进制 (Don Howard ) [229885] {CVE-2007-0958}
     - [xen] 在内存 > 64G 的计算机上启用启动 (Chris Lalancette) [230117]
     - 修复 cardman 4040 cmx 驱动程序中的潜在缓冲区溢出 (Don Howard) [229884] {CVE-2007-0005}

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0005     Daniel Roethlisberger discovered two buffer overflows in     the cm4040 driver for the Omnikey CardMan 4040 device. A     local user or malicious device could exploit this to     execute arbitrary code in kernel space.

  - CVE-2007-0958     Santosh Eraniose reported a vulnerability that allows     local users to read otherwise unreadable files by     triggering a core dump while using PT_INTERP. This is     related to CVE-2004-1073.

  - CVE-2007-1357     Jean Delvare reported a vulnerability in the appletalk     subsystem. Systems with the appletalk module loaded can     be triggered to crash by other systems on the local     network via a malformed frame.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

Rebased to kernel 2.6.20.3-rc1 :

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.1 (The CVE fix in 2.6.20.1 is already in kernel-2.6.19-1.2911.6.5.fc6.) http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.2 Changelog for 2.6.20.3 is not available yet.

This release does not include Xen kernels.

CVE-2007-0005: A vulnerability has been reported in the Linux Kernel, which potentially can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

The vulnerability is caused due to boundary errors within the 'read()' and 'write()' functions of the Omnikey CardMan 4040 driver. This can be exploited to cause a buffer overflow and may allow the execution of arbitrary code with kernel privileges. 

CVE-2007-1000: A vulnerability has been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or disclose potentially sensitive information.

The vulnerability is due to a NULL pointer dereference within the 'ipv6_getsockopt_sticky()' function in net/ipv6/ipv6_sockglue.c. This can be exploited to crash the kernel or disclose kernel memory.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in dvb ULE decapsulation. A remote attacker could send a specially crafted message and cause a denial of service.
(CVE-2006-4623)

The compat_sys_mount function allowed local users to cause a denial of service when mounting a smbfs filesystem in compatibility mode.
(CVE-2006-7203)

The Omnikey CardMan 4040 driver (cm4040_cs) did not limit the size of buffers passed to read() and write(). A local attacker could exploit this to execute arbitrary code with kernel privileges. (CVE-2007-0005)

Due to an variable handling flaw in the ipv6_getsockopt_sticky() function a local attacker could exploit the getsockopt() calls to read arbitrary kernel memory. This could disclose sensitive data.
(CVE-2007-1000)

Ilja van Sprundel discovered that Bluetooth setsockopt calls could leak kernel memory contents via an uninitialized stack buffer. A local attacker could exploit this flaw to view sensitive kernel information.
(CVE-2007-1353)

A flaw was discovered in the handling of netlink messages. Local attackers could cause infinite recursion leading to a denial of service. (CVE-2007-1861)

The random number generator was hashing a subset of the available entropy, leading to slightly less random numbers. Additionally, systems without an entropy source would be seeded with the same inputs at boot time, leading to a repeatable series of random numbers.
(CVE-2007-2453)

A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. (CVE-2007-2525)

An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel memory using large file offsets while reading the tasks file. This could disclose sensitive data. (CVE-2007-2875)

Vilmos Nebehaj discovered that the SCTP netfilter code did not correctly validate certain states. A remote attacker could send a specially crafted packet causing a denial of service. (CVE-2007-2876)

Luca Tettamanti discovered a flaw in the VFAT compat ioctls on 64-bit systems. A local attacker could corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878)

A flaw was discovered in the cluster manager. A remote attacker could connect to the DLM port and block further DLM operations.
(CVE-2007-3380)

A flaw was discovered in the usblcd driver. A local attacker could cause large amounts of kernel memory consumption, leading to a denial of service. (CVE-2007-3513).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
24944	Mandrake Linux Security Advisory : kernel (MDKSA-2007:078)	Nessus	Mandriva Local Security Checks	2007/4/5	2021/1/6	high
67495	Oracle Linux 5重要度高/カーネルELSA-2007-0347	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
25319	RHEL 5 : kernel (RHSA-2007:0099)	Nessus	Red Hat Local Security Checks	2007/5/25	2021/1/14	medium
67495	Oracle Linux 5 : Important: / kernel (ELSA-2007-0347)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
24823	Fedora Core 6 : kernel-2.6.20-1.2925.fc6 (2007-335)	Nessus	Fedora Local Security Checks	2007/3/16	2021/1/11	high
28087	Ubuntu 6.10 : linux-source-2.6.17 vulnerabilities (USN-486-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
67495	Oracle Linux 5重要/核心 (ELSA-2007-0347)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
67495	Oracle Linux 5重要/ 内核 (ELSA-2007-0347)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
25153	Debian DSA-1286-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	2007/5/3	2021/1/4	high
24824	Fedora Core 5 : kernel-2.6.20-1.2300.fc5 (2007-336)	Nessus	Fedora Local Security Checks	2007/3/16	2021/1/11	high
28090	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerability (USN-489-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high

检测

插件搜索

high

medium

medium

medium

high

high

medium

medium

high

high

high