[SUSE-Announcements] BES Auto Notification: New Fixlets Published in Fixlet Site: PatchesforSUSELinuxEnterprise

[Notification of New SUSE Fixlet Messages]

Fixlet Site - PatchesforSUSELinuxEnterprise
Current Version: 283	Published: Thu, 17 Dec 2009 20:09:32  GMT

New Fixlets:
============

***************************************************************
Title: PATCH-B9121401 - Security update for Linux Kernel (x86) - SLED10 SP3
Severity: <Unspecified>
Fixlet ID: 912140101
Fixlet Link: http://download.novell.com/Download?buildid=7RXelQrNY1k~

Fixlet Description: This update fixes various bugs and some security issues in the SUSE Linux Enterprise 10 SP 3 kernel.  The following security issues were fixed:  A sysctl variable of the megaraid_sas driver was world-writeable, allowing local users to cause a denial of service or potential code execution. (CVE-2009-3939) The collect_rx_frame() function in drivers/isdn/hisax/hfc_usb. c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arives over ISDN and triggers a buffer under-read. (CVE-2009-4005) A negative offset in an ioctl of the GDTH RAID driver was fixed. (CVE-2009-3080) The fuse_direct_io() function in fs/fuse/file. c in the fuse subsystem in the Linux kernel might allow attackers to cause a denial of service by an invalid pointer dereference and subsequent OOPS via vectors possibly related to a memory-consumption attack. (CVE-2009-4021) A memory leak in the appletalk subsystem of the Linux kernel when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams. (CVE-2009-2903) net/1/af_unix. c in the Linux kernel allows local users to cause a denial of service (system hang) by creating an abstract namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. (CVE-2009-3621) The tcf_fill_node() function in net/sched/cls_api. c of the netlink subsystem in the Linux kernel 2.6. x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member. This might allow local users to obtain sensitive information from kernel memory via unspecified vectors.  (CVE-2009-3612, CVE-2005-4881 — NOTE: this issue exists because of a previous incomplete fix for CVE-2005-4881. ) The ATI Rage 128 (aka r128) kernel driver does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. (CVE-2009-3620) The nfs4_proc_lock() function in fs/nfs/nfs4proc. c of the NFSv4 client in the Linux kernel allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes. This triggers an attempt to use an open file without an NFSv4 state. (CVE-2009-3726)  The rio and sx serial multiport card drivers were disabled via the modprobe blacklist due to severe bugs.  For a full list of changes, please refer the RPM changelog. Everyone using the Linux Kernel on x86 architecture should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9121401 - Security update for Linux Kernel (x86) - SLES10 SP3
Severity: <Unspecified>
Fixlet ID: 912140103
Fixlet Link: http://download.novell.com/Download?buildid=RaPWmTjpwKk~

Fixlet Description: This update fixes various bugs and some security issues in the SUSE Linux Enterprise 10 SP 3 kernel.  The following security issues were fixed:  A sysctl variable of the megaraid_sas driver was world-writeable, allowing local users to cause a denial of service or potential code execution. (CVE-2009-3939) The collect_rx_frame() function in drivers/isdn/hisax/hfc_usb. c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arives over ISDN and triggers a buffer under-read. (CVE-2009-4005) A negative offset in an ioctl of the GDTH RAID driver was fixed. (CVE-2009-3080) The fuse_direct_io() function in fs/fuse/file. c in the fuse subsystem in the Linux kernel might allow attackers to cause a denial of service by an invalid pointer dereference and subsequent OOPS via vectors possibly related to a memory-consumption attack. (CVE-2009-4021) A memory leak in the appletalk subsystem of the Linux kernel when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams. (CVE-2009-2903) net/1/af_unix. c in the Linux kernel allows local users to cause a denial of service (system hang) by creating an abstract namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. (CVE-2009-3621) The tcf_fill_node() function in net/sched/cls_api. c of the netlink subsystem in the Linux kernel 2.6. x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member. This might allow local users to obtain sensitive information from kernel memory via unspecified vectors.  (CVE-2009-3612, CVE-2005-4881 — NOTE: this issue exists because of a previous incomplete fix for CVE-2005-4881. ) The ATI Rage 128 (aka r128) kernel driver does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. (CVE-2009-3620) The nfs4_proc_lock() function in fs/nfs/nfs4proc. c of the NFSv4 client in the Linux kernel allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes. This triggers an attempt to use an open file without an NFSv4 state. (CVE-2009-3726)  The rio and sx serial multiport card drivers were disabled via the modprobe blacklist due to severe bugs.  For a full list of changes, please refer the RPM changelog. Everyone using the Linux Kernel on x86 architecture should update. Please see patch page for more detailed information.