[Technik] [SECURITY] [DSA 1479-1] New Linux 2.6.18 packages fix several vulnerabilities

[Noèl Köthe]

Am Dienstag, den 29.01.2008, 11:04 -0700 schrieb dann frazier:

> Debian Security Advisory DSA-1479                    security at debian.org
> http://www.debian.org/security/                             dann frazier
> January 29, 2008                      http://www.debian.org/security/faq
> 
> Package        : linux-2.6
> Vulnerability  : several
> Problem-Type   : local
> Debian-specific: no
> CVE ID         : CVE-2007-2878 CVE-2007-4571 CVE-2007-6151 CVE-2008-0001

linux-2.6 auf cree, yuma und yuki aktualisiert.
cree und yuma wurden rebootet, damit der neue Kernel genutzt wird.
yuki wird in den nächsten Tagen rebootet, wenn Simon vor Ort am Rechner
ist.

> These problems have been fixed in the stable distribution in version
> 2.6.18.dfsg.1-17etch1.

changelog:
linux-2.6 (2.6.18.dfsg.1-17etch1) stable-security; urgency=high

  * bugfix/i4l-isdn_ioctl-mem-overrun.patch
    [SECURITY] Fix potential isdn ioctl memory overrun
    See CVE-2007-6151
  * bugfix/vfs-use-access-mode-flag.patch
    [SECURITY] Use the access mode flag instead of the open flag when
    testing access mode for a directory. Modify
    features/all/vserver/vs2.0.2.2-rc9.patch to apply on top of this
    See CVE-2008-0001
  * bugfix/fat-move-ioctl-compat-code.patch, bugfix/fat-fix-compat-ioctls.patch
    [SECURITY][ABI Changer] Fix kernel_dirent corruption in the compat layer
    for fat ioctls
    See CVE-2007-2878
  * bugfix/proc-snd-page-alloc-mem-leak.patch
    [SECURITY][ABI Changer] Fix an issue in the alsa subsystem that allows a
    local user to read potentially sensitive kernel memory from the proc
    filesystem
    See CVE-2007-4571
  * Bump ABI to 6.

 -- dann frazier <dannf at debian.org>  Tue, 22 Jan 2008 10:07:04 -0700

-- 
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : /archiv/technik/attachments/20080131/e7c6dd8f/attachment.pgp