New Linux 2.6.18 packages fix several vulnerabilities

Discussion in 'General Chat' started by comboy, Sep 30, 2007.

  1. #1
    For who use Linux
    [​IMG]

    Upgrade Instructions
    - --------------------

    wget url
    will fetch the file for you
    dpkg -i file.deb
    will install the referenced file.

    If you are using the apt-get package manager, use the line for
    sources.list as given below:

    apt-get update
    will update the internal database
    apt-get upgrade
    will install corrected packages


    Several local and remote vulnerabilities have been discovered in the Linux
    kernel that may lead to a denial of service or the execution of arbitrary
    code. The Common Vulnerabilities and Exposures project identifies the
    following problems:

    CVE-2007-3731

    Evan Teran discovered a potential local denial of service (oops) in
    the handling of PTRACE_SETREGS and PTRACE_SINGLESTEP requests.

    CVE-2007-3739

    Adam Litke reported a potential local denial of service (oops) on
    powerpc platforms resulting from unchecked VMA expansion into address
    space reserved for hugetlb pages.

    CVE-2007-3740

    Steve French reported that CIFS filesystems with CAP_UNIX enabled
    were not honoring a process' umask which may lead to unintentinally
    relaxed permissions.

    CVE-2007-4573

    Wojciech Purczynski discovered a vulnerability that can be exploitd
    by a local user to obtain superuser privileges on x86_64 systems.
    This resulted from improper clearing of the high bits of registers
    during ia32 system call emulation. This vulnerability is relevant
    to the Debian amd64 port as well as users of the i386 port who run
    the amd64 linux-image flavour.

    CVE-2007-4849

    Michael Stone reported an issue with the JFFS2 filesystem. Legacy
    modes for inodes that were created with POSIX ACL support enabled
    were not being written out to the medium, resulting in incorrect
    permissions upon remount.

    These problems have been fixed in the stable distribution in version
    2.6.18.dfsg.1-13etch3.
     
    comboy, Sep 30, 2007 IP