| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2007:1049.
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
A flaw was found in the handling of process death signals. This allowed a
local user to send arbitrary signals to the suid-process executed by that
user. A successful exploitation of this flaw depends on the structure of
the suid-program and its signal handling. (CVE-2007-3848, Important)
A flaw was found in the IPv4 forwarding base. This allowed a local user to
cause a denial of service. (CVE-2007-2172, Important)
A flaw was found where a corrupted executable file could cause cross-region
memory mappings on Itanium systems. This allowed a local user to cause a
denial of service. (CVE-2006-4538, Moderate)
A flaw was found in the stack expansion when using the hugetlb kernel on
PowerPC systems. This allowed a local user to cause a denial of service.
(CVE-2007-3739, Moderate)
A flaw was found in the aacraid SCSI driver. This allowed a local user to
make ioctl calls to the driver that should be restricted to privileged
users. (CVE-2007-4308, Moderate)
As well, these updated packages fix the following bug:
* a bug in the TCP header prediction code may have caused TCP: Treason
uncloaked! messages to be logged. In certain situations this may have lead
to TCP connections hanging or aborting.
Red Hat Enterprise Linux 3 users are advised to upgrade to these updated
packages, which contain backported patches to resolve these issues.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2007-1049.html
http://www.redhat.com/security/updates/classification/#important
Risk factor : Medium
CVSS Score:
4.9
|
