| Descripción: | Description:
The remote host is missing an update to kernel
announced via advisory MDVSA-2010:066.
Some vulnerabilities were discovered and corrected in the Linux
2.6 kernel:
The gfs2_lock function in the Linux kernel before
2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux
kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly
remove POSIX locks on files that are setgid without group-execute
permission, which allows local users to cause a denial of service
(BUG and system crash) by locking a file on a (1) GFS or (2) GFS2
filesystem, and then changing this file's permissions. (CVE-2010-0727)
The do_pages_move function in mm/migrate.c in the Linux kernel before
2.6.33-rc7 does not validate node values, which allows local users
to read arbitrary kernel memory locations, cause a denial of service
(OOPS), and possibly have unspecified other impact by specifying a
node that is not part of the kernel's node set. (CVE-2010-0415)
drivers/net/e1000e/netdev.c in the e1000e driver in the Linux
kernel 2.6.32.3 and earlier does not properly check the size of an
Ethernet frame that exceeds the MTU, which allows remote attackers
to have an unspecified impact via crafted packets, a related issue
to CVE-2009-4537. (CVE-2009-4538)
The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel
before 2.6.32.8 on the x86_64 platform does not ensure that the
ELF interpreter is available before a call to the SET_PERSONALITY
macro, which allows local users to cause a denial of service (system
crash) via a 32-bit application that attempts to execute a 64-bit
application and then triggers a segmentation fault, as demonstrated by
amd64_killer, related to the flush_old_exec function. (CVE-2010-0307)
Aditionally, it was added support for some backlight models used in
Samsung laptops and fixes to detect Saitek X52 joysticks.
To update your kernel, please follow the directions located at:
http://www.mandriva.com/en/security/kernelupdate
Affected: 2010.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2010:066
Risk factor : Critical
CVSS Score:
10.0
|
