The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0147 advisory.

    - [net] sctp: backport cleanups for ootb handling V2 (Neil Horman) [555666 555667] {CVE-2010-0008}
    - Reverting: [net] sctp: backport cleanups for ootb handling (Neil Horman) [555666 555667] {CVE-2010-0008}
    - [fs] ext4: Avoid null pointer dereference when decoding EROFS w/o a journal (Jiri Pirko) [547256 547257]     {CVE-2009-4308}
    - [net] sctp: backport cleanups for ootb handling (Neil Horman) [555666 555667] {CVE-2010-0008}
    - [mm] fix sys_move_pages infoleak (Eugene Teo) [562589 562590] {CVE-2010-0415}
    - [net] netfilter: enforce CAP_NET_ADMIN in ebtables (Danny Feng) [555242 555243] {CVE-2010-0007}
    - [misc] fix kernel info leak with print-fatal-signals=1 (Danny Feng) [554583 554584] {CVE-2010-0003}
    - [net] e1000: fix rx length check errors (Neil Horman) [552137 552138] {CVE-2009-4536}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2010:0146 :

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a NULL pointer dereference flaw was found in the sctp_rcv_ootb() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to a target system, resulting in a denial of service. (CVE-2010-0008, Important)

* a NULL pointer dereference flaw was found in the Linux kernel.
During a core dump, the kernel did not check if the Virtual Dynamically-linked Shared Object page was accessible. On Intel 64 and AMD64 systems, a local, unprivileged user could use this flaw to cause a kernel panic by running a crafted 32-bit application.
(CVE-2009-4271, Important)

* an information leak was found in the print_fatal_signal() implementation in the Linux kernel. When '/proc/sys/kernel/print-fatal-signals' is set to 1 (the default value is 0), memory that is reachable by the kernel could be leaked to user-space. This issue could also result in a system crash. Note that this flaw only affected the i386 architecture. (CVE-2010-0003, Moderate)

* on AMD64 systems, it was discovered that the kernel did not ensure the ELF interpreter was available before making a call to the SET_PERSONALITY macro. A local attacker could use this flaw to cause a denial of service by running a 32-bit application that attempts to execute a 64-bit application. (CVE-2010-0307, Moderate)

* missing capability checks were found in the ebtables implementation, used for creating an Ethernet bridge firewall. This could allow a local, unprivileged user to bypass intended capability restrictions and modify ebtables rules. (CVE-2010-0007, Low)

This update also fixes the following bugs :

* under some circumstances, a locking bug could have caused an online ext3 file system resize to deadlock, which may have, in turn, caused the file system or the entire system to become unresponsive. In either case, a reboot was required after the deadlock. With this update, using resize2fs to perform an online resize of an ext3 file system works as expected. (BZ#553135)

* some ATA and SCSI devices were not honoring the barrier=1 mount option, which could result in data loss after a crash or power loss.
This update applies a patch to the Linux SCSI driver to ensure ordered write caching. This solution does not provide cache flushes; however, it does provide data integrity on devices that have no write caching (or where write caching is disabled) and no command queuing. For systems that have command queuing or write cache enabled there is no guarantee of data integrity after a crash. (BZ#560563)

* it was found that lpfc_find_target() could loop continuously when scanning a list of nodes due to a missing spinlock. This missing spinlock allowed the list to be changed after the list_empty() test, resulting in a NULL value, causing the loop. This update adds the spinlock, resolving the issue. (BZ#561453)

* the fix for CVE-2009-4538 provided by RHSA-2010:0020 introduced a regression, preventing Wake on LAN (WoL) working for network devices using the Intel PRO/1000 Linux driver, e1000e. Attempting to configure WoL for such devices resulted in the following error, even when configuring valid options :

'Cannot set new wake-on-lan settings: Operation not supported not setting wol'

This update resolves this regression, and WoL now works as expected for network devices using the e1000e driver. (BZ#565496)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Security fixes :

  - a NULL pointer dereference flaw was found in the     sctp_rcv_ootb() function in the Linux kernel Stream     Control Transmission Protocol (SCTP) implementation. A     remote attacker could send a specially crafted SCTP     packet to a target system, resulting in a denial of     service. (CVE-2010-0008, Important)

  - a missing boundary check was found in the     do_move_pages() function in the memory migration     functionality in the Linux kernel. A local user could     use this flaw to cause a local denial of service or an     information leak. (CVE-2010-0415, Important)

  - a NULL pointer dereference flaw was found in the     ip6_dst_lookup_tail() function in the Linux kernel. An     attacker on the local network could trigger this flaw by     sending IPv6 traffic to a target system, leading to a     system crash (kernel OOPS) if dst->neighbour is NULL on     the target system when receiving an IPv6 packet.
    (CVE-2010-0437, Important)

  - a NULL pointer dereference flaw was found in the ext4     file system code in the Linux kernel. A local attacker     could use this flaw to trigger a local denial of service     by mounting a specially crafted, journal-less ext4 file     system, if that file system forced an EROFS error.
    (CVE-2009-4308, Moderate)

  - an information leak was found in the     print_fatal_signal() implementation in the Linux kernel.
    When '/proc/sys/kernel/print-fatal-signals' is set to 1     (the default value is 0), memory that is reachable by     the kernel could be leaked to user-space. This issue     could also result in a system crash. Note that this flaw     only affected the i386 architecture. (CVE-2010-0003,     Moderate)

  - missing capability checks were found in the ebtables     implementation, used for creating an Ethernet bridge     firewall. This could allow a local, unprivileged user to     bypass intended capability restrictions and modify     ebtables rules. (CVE-2010-0007, Low)

Bug fixes :

  - a bug prevented Wake on LAN (WoL) being enabled on     certain Intel hardware. (BZ#543449)

  - a race issue in the Journaling Block Device. (BZ#553132)

  - programs compiled on x86, and that also call     sched_rr_get_interval(), were silently corrupted when     run on 64-bit systems. (BZ#557684)

  - the RHSA-2010:0019 update introduced a regression,     preventing WoL from working for network devices using     the e1000e driver. (BZ#559335)

  - adding a bonding interface in mode balance-alb to a     bridge was not functional. (BZ#560588)

  - some KVM (Kernel-based Virtual Machine) guests     experienced slow performance (and possibly a crash)     after suspend/resume. (BZ#560640)

  - on some systems, VF cannot be enabled in dom0.
    (BZ#560665)

  - on systems with certain network cards, a system crash     occurred after enabling GRO. (BZ#561417)

  - for x86 KVM guests with pvclock enabled, the boot clocks     were registered twice, possibly causing KVM to write     data to a random memory area during the guest's life.
    (BZ#561454)

  - serious performance degradation for 32-bit applications,     that map (mmap) thousands of small files, when run on a     64-bit system. (BZ#562746)

  - improved kexec/kdump handling. Previously, on some     systems under heavy load, kexec/kdump was not     functional. (BZ#562772)

  - dom0 was unable to boot when using the Xen hypervisor on     a system with a large number of logical CPUs.
    (BZ#562777)

  - a fix for a bug that could potentially cause file system     corruption. (BZ#564281)

  - a bug caused infrequent cluster issues for users of     GFS2. (BZ#564288)

  - gfs2_delete_inode failed on read-only file systems.
    (BZ#564290)

The system must be rebooted for this update to take effect.

This update fixes the following security issues :

  - a NULL pointer dereference flaw was found in the     sctp_rcv_ootb() function in the Linux kernel Stream     Control Transmission Protocol (SCTP) implementation. A     remote attacker could send a specially crafted SCTP     packet to a target system, resulting in a denial of     service. (CVE-2010-0008, Important)

  - a NULL pointer dereference flaw was found in the Linux     kernel. During a core dump, the kernel did not check if     the Virtual Dynamically-linked Shared Object page was     accessible. On Intel 64 and AMD64 systems, a local,     unprivileged user could use this flaw to cause a kernel     panic by running a crafted 32-bit application.
    (CVE-2009-4271, Important)

  - an information leak was found in the     print_fatal_signal() implementation in the Linux kernel.
    When '/proc/sys/kernel/print-fatal-signals' is set to 1     (the default value is 0), memory that is reachable by     the kernel could be leaked to user-space. This issue     could also result in a system crash. Note that this flaw     only affected the i386 architecture. (CVE-2010-0003,     Moderate)

  - on AMD64 systems, it was discovered that the kernel did     not ensure the ELF interpreter was available before     making a call to the SET_PERSONALITY macro. A local     attacker could use this flaw to cause a denial of     service by running a 32-bit application that attempts to     execute a 64-bit application. (CVE-2010-0307, Moderate)

  - missing capability checks were found in the ebtables     implementation, used for creating an Ethernet bridge     firewall. This could allow a local, unprivileged user to     bypass intended capability restrictions and modify     ebtables rules. (CVE-2010-0007, Low)

This update also fixes the following bugs :

  - under some circumstances, a locking bug could have     caused an online ext3 file system resize to deadlock,     which may have, in turn, caused the file system or the     entire system to become unresponsive. In either case, a     reboot was required after the deadlock. With this     update, using resize2fs to perform an online resize of     an ext3 file system works as expected. (BZ#553135)

  - some ATA and SCSI devices were not honoring the     barrier=1 mount option, which could result in data loss     after a crash or power loss. This update applies a patch     to the Linux SCSI driver to ensure ordered write     caching. This solution does not provide cache flushes;
    however, it does provide data integrity on devices that     have no write caching (or where write caching is     disabled) and no command queuing. For systems that have     command queuing or write cache enabled there is no     guarantee of data integrity after a crash. (BZ#560563)

  - it was found that lpfc_find_target() could loop     continuously when scanning a list of nodes due to a     missing spinlock. This missing spinlock allowed the list     to be changed after the list_empty() test, resulting in     a NULL value, causing the loop. This update adds the     spinlock, resolving the issue. (BZ#561453)

  - the fix for CVE-2009-4538 provided by RHSA-2010:0020     introduced a regression, preventing Wake on LAN (WoL)     working for network devices using the Intel PRO/1000     Linux driver, e1000e. Attempting to configure WoL for     such devices resulted in the following error, even when     configuring valid options :

    'Cannot set new wake-on-lan settings: Operation not     supported not setting wol'

This update resolves this regression, and WoL now works as expected for network devices using the e1000e driver. (BZ#565496)

The system must be rebooted for this update to take effect.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

Security update: CVE-2010-0003 CVE-2010-0006 CVE-2010-0007

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a NULL pointer dereference flaw was found in the sctp_rcv_ootb() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to a target system, resulting in a denial of service. (CVE-2010-0008, Important)

* a missing boundary check was found in the do_move_pages() function in the memory migration functionality in the Linux kernel. A local user could use this flaw to cause a local denial of service or an information leak. (CVE-2010-0415, Important)

* a NULL pointer dereference flaw was found in the ip6_dst_lookup_tail() function in the Linux kernel. An attacker on the local network could trigger this flaw by sending IPv6 traffic to a target system, leading to a system crash (kernel OOPS) if dst->neighbour is NULL on the target system when receiving an IPv6 packet. (CVE-2010-0437, Important)

* a NULL pointer dereference flaw was found in the ext4 file system code in the Linux kernel. A local attacker could use this flaw to trigger a local denial of service by mounting a specially crafted, journal-less ext4 file system, if that file system forced an EROFS error. (CVE-2009-4308, Moderate)

* an information leak was found in the print_fatal_signal() implementation in the Linux kernel. When '/proc/sys/kernel/print-fatal-signals' is set to 1 (the default value is 0), memory that is reachable by the kernel could be leaked to user-space. This issue could also result in a system crash. Note that this flaw only affected the i386 architecture. (CVE-2010-0003, Moderate)

* missing capability checks were found in the ebtables implementation, used for creating an Ethernet bridge firewall. This could allow a local, unprivileged user to bypass intended capability restrictions and modify ebtables rules. (CVE-2010-0007, Low)

Bug fixes :

* a bug prevented Wake on LAN (WoL) being enabled on certain Intel hardware. (BZ#543449)

* a race issue in the Journaling Block Device. (BZ#553132)

* programs compiled on x86, and that also call sched_rr_get_interval(), were silently corrupted when run on 64-bit systems. (BZ#557684)

* the RHSA-2010:0019 update introduced a regression, preventing WoL from working for network devices using the e1000e driver. (BZ#559335)

* adding a bonding interface in mode balance-alb to a bridge was not functional. (BZ#560588)

* some KVM (Kernel-based Virtual Machine) guests experienced slow performance (and possibly a crash) after suspend/resume. (BZ#560640)

* on some systems, VF cannot be enabled in dom0. (BZ#560665)

* on systems with certain network cards, a system crash occurred after enabling GRO. (BZ#561417)

* for x86 KVM guests with pvclock enabled, the boot clocks were registered twice, possibly causing KVM to write data to a random memory area during the guest's life. (BZ#561454)

* serious performance degradation for 32-bit applications, that map (mmap) thousands of small files, when run on a 64-bit system.
(BZ#562746)

* improved kexec/kdump handling. Previously, on some systems under heavy load, kexec/kdump was not functional. (BZ#562772)

* dom0 was unable to boot when using the Xen hypervisor on a system with a large number of logical CPUs. (BZ#562777)

* a fix for a bug that could potentially cause file system corruption.
(BZ#564281)

* a bug caused infrequent cluster issues for users of GFS2.
(BZ#564288)

* gfs2_delete_inode failed on read-only file systems. (BZ#564290)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a NULL pointer dereference flaw was found in the sctp_rcv_ootb() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to a target system, resulting in a denial of service. (CVE-2010-0008, Important)

* a NULL pointer dereference flaw was found in the Linux kernel.
During a core dump, the kernel did not check if the Virtual Dynamically-linked Shared Object page was accessible. On Intel 64 and AMD64 systems, a local, unprivileged user could use this flaw to cause a kernel panic by running a crafted 32-bit application.
(CVE-2009-4271, Important)

* an information leak was found in the print_fatal_signal() implementation in the Linux kernel. When '/proc/sys/kernel/print-fatal-signals' is set to 1 (the default value is 0), memory that is reachable by the kernel could be leaked to user-space. This issue could also result in a system crash. Note that this flaw only affected the i386 architecture. (CVE-2010-0003, Moderate)

* on AMD64 systems, it was discovered that the kernel did not ensure the ELF interpreter was available before making a call to the SET_PERSONALITY macro. A local attacker could use this flaw to cause a denial of service by running a 32-bit application that attempts to execute a 64-bit application. (CVE-2010-0307, Moderate)

* missing capability checks were found in the ebtables implementation, used for creating an Ethernet bridge firewall. This could allow a local, unprivileged user to bypass intended capability restrictions and modify ebtables rules. (CVE-2010-0007, Low)

This update also fixes the following bugs :

* under some circumstances, a locking bug could have caused an online ext3 file system resize to deadlock, which may have, in turn, caused the file system or the entire system to become unresponsive. In either case, a reboot was required after the deadlock. With this update, using resize2fs to perform an online resize of an ext3 file system works as expected. (BZ#553135)

* some ATA and SCSI devices were not honoring the barrier=1 mount option, which could result in data loss after a crash or power loss.
This update applies a patch to the Linux SCSI driver to ensure ordered write caching. This solution does not provide cache flushes; however, it does provide data integrity on devices that have no write caching (or where write caching is disabled) and no command queuing. For systems that have command queuing or write cache enabled there is no guarantee of data integrity after a crash. (BZ#560563)

* it was found that lpfc_find_target() could loop continuously when scanning a list of nodes due to a missing spinlock. This missing spinlock allowed the list to be changed after the list_empty() test, resulting in a NULL value, causing the loop. This update adds the spinlock, resolving the issue. (BZ#561453)

* the fix for CVE-2009-4538 provided by RHSA-2010:0020 introduced a regression, preventing Wake on LAN (WoL) working for network devices using the Intel PRO/1000 Linux driver, e1000e. Attempting to configure WoL for such devices resulted in the following error, even when configuring valid options :

'Cannot set new wake-on-lan settings: Operation not supported not setting wol'

This update resolves this regression, and WoL now works as expected for network devices using the e1000e driver. (BZ#565496)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.45 fixing various bugs and security issues.

  - The wake_futex_pi function in kernel/futex.c in the     Linux kernel before 2.6.33-rc7 does not properly handle     certain unlock operations for a Priority Inheritance     (PI) futex, which allows local users to cause a denial     of service (OOPS) and possibly have unspecified other     impact via vectors involving modification of the futex     value from user space. (CVE-2010-0622)

  - The load_elf_binary function in fs/binfmt_elf.c in the     Linux kernel before 2.6.32.8 on the x86_64 platform does     not ensure that the ELF interpreter is available before     a call to the SET_PERSONALITY macro, which allows local     users to cause a denial of service (system crash) via a     32-bit application that attempts to execute a 64-bit     application and then triggers a segmentation fault, as     demonstrated by amd64_killer, related to the     flush_old_exec function. (CVE-2010-0307)

  - Users could send/allocate arbitrary amounts of     NETLINK_CONNECTOR messages to the kernel, causing OOM     condition, killing selected processes or halting the     system. (CVE-2010-0410)

  - The do_pages_move function in mm/migrate.c in the Linux     kernel before 2.6.33-rc7 does not validate node values,     which allows local users to read arbitrary kernel memory     locations, cause a denial of service (OOPS), and     possibly have unspecified other impact by specifying a     node that is not part of the kernels node set.
    (CVE-2010-0415)

  - net/bridge/netfilter/ebtables.c in the ebtables module     in the netfilter framework in the Linux kernel before     2.6.33-rc4 does not require the CAP_NET_ADMIN capability     for setting or modifying rules, which allows local users     to bypass intended access restrictions and configure     arbitrary network-traffic filtering via a modified     ebtables application. (CVE-2010-0007)

  - drivers/net/e1000/e1000_main.c in the e1000 driver in     the Linux kernel 2.6.32.3 and earlier handles Ethernet     frames that exceed the MTU by processing certain     trailing payload data as if it were a complete frame,     which allows remote attackers to bypass packet filters     via a large packet with a crafted payload.
    (CVE-2009-4536)

  - drivers/net/e1000e/netdev.c in the e1000e driver in the     Linux kernel 2.6.32.3 and earlier does not properly     check the size of an Ethernet frame that exceeds the     MTU, which allows remote attackers to have an     unspecified impact via crafted packets. (CVE-2009-4538)

  - The print_fatal_signal function in kernel/signal.c in     the Linux kernel before 2.6.32.4 on the i386 platform,     when print-fatal-signals is enabled, allows local users     to discover the contents of arbitrary memory locations     by jumping to an address and then reading a log file,     and might allow local users to cause a denial of service     (system slowdown or crash) by jumping to an address.
    (CVE-2010-0003)

  - The poll_mode_io file for the megaraid_sas driver in the     Linux kernel 2.6.31.6 and earlier has world-writable     permissions, which allows local users to change the I/O     mode of the driver by modifying this file.
    (CVE-2009-3939)

The openSUSE 11.1 Kernel was updated to 2.6.27.42 fixing various bugs and security issues.

CVE-2010-0622: The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space.

CVE-2010-0307: The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.

CVE-2010-0410: Users could send/allocate arbitrary amounts of NETLINK_CONNECTOR messages to the kernel, causing OOM condition, killing selected processes or halting the system.

CVE-2010-0415: The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.

CVE-2010-0007: net/bridge/netfilter/ebtables.c in the ebtables module in the netfilter framework in the Linux kernel before 2.6.33-rc4 does not require the CAP_NET_ADMIN capability for setting or modifying rules, which allows local users to bypass intended access restrictions and configure arbitrary network-traffic filtering via a modified ebtables application.

CVE-2009-4536: drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.

CVE-2009-4538: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets.

CVE-2010-0003: The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.

CVE-2009-3939: The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

NOTE: This kernel update marks the final planned kernel security update for the 2.6.24 kernel in the Debian release 'etch'. Although security support for 'etch' officially ended on Feburary 15th, 2010, this update was already in preparation before that date.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2691     Steve Beattie and Kees Cook reported an information leak     in the maps and smaps files available under /proc. Local     users may be able to read this data for setuid processes     while the ELF binary is being loaded.

  - CVE-2009-2695     Eric Paris provided several fixes to increase the     protection provided by the mmap_min_addr tunable against     NULL pointer dereference vulnerabilities.

  - CVE-2009-3080     Dave Jones reported an issue in the gdth SCSI driver. A     missing check for negative offsets in an ioctl call     could be exploited by local users to create a denial of     service or potentially gain elevated privileges.

  - CVE-2009-3726     Trond Myklebust reported an issue where a malicious NFS     server could cause a denial of service condition on its     clients by returning incorrect attributes during an open     call.

  - CVE-2009-3889     Joe Malicki discovered an issue in the megaraid_sas     driver. Insufficient permissions on the sysfs dbg_lvl     interface allow local users to modify the debug logging     behavior.

  - CVE-2009-4005     Roel Kluin discovered an issue in the hfc_usb driver, an     ISDN driver for Colognechip HFC-S USB chip. A potential     read overflow exists which may allow remote users to     cause a denial of service condition (oops).

  - CVE-2009-4020     Amerigo Wang discovered an issue in the HFS filesystem     that would allow a denial of service by a local user who     has sufficient privileges to mount a specially crafted     filesystem.

  - CVE-2009-4021     Anana V. Avati discovered an issue in the fuse     subsystem. If the system is sufficiently low on memory,     a local user can cause the kernel to dereference an     invalid pointer resulting in a denial of service (oops)     and potentially an escalation of privileges.

  - CVE-2009-4138     Jay Fenlason discovered an issue in the firewire stack     that allows local users to cause a denial of service     (oops or crash) by making a specially crafted ioctl     call.

  - CVE-2009-4308     Ted Ts'o discovered an issue in the ext4 filesystem that     allows local users to cause a denial of service (NULL     pointer dereference). For this to be exploitable, the     local user must have sufficient privileges to mount a     filesystem.

  - CVE-2009-4536 CVE-2009-4538     Fabian Yamaguchi reported issues in the e1000 and e1000e     drivers for Intel gigabit network adapters which allow     remote users to bypass packet filters using specially     crafted Ethernet frames.

  - CVE-2010-0003     Andi Kleen reported a defect which allows local users to     gain read access to memory reachable by the kernel when     the print-fatal-signals option is enabled. This option     is disabled by default.

  - CVE-2010-0007     Florian Westphal reported a lack of capability checking     in the ebtables netfilter subsystem. If the ebtables     module is loaded, local users can add and modify     ebtables rules.

  - CVE-2010-0291     Al Viro reported several issues with the mmap/mremap     system calls that allow local users to cause a denial of     service (system panic) or obtain elevated privileges.

  - CVE-2010-0410     Sebastian Krahmer discovered an issue in the netlink     connector subsystem that permits local users to allocate     large amounts of system memory resulting in a denial of     service (out of memory).

  - CVE-2010-0415     Ramon de Carvalho Valle discovered an issue in the     sys_move_pages interface, limited to amd64, ia64 and     powerpc64 flavors in Debian. Local users can exploit     this issue to cause a denial of service (system crash)     or gain access to sensitive kernel memory.

  - CVE-2010-0622     Jerome Marchand reported an issue in the futex subsystem     that allows a local user to force an invalid futex state     which results in a denial of service (oops).

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3939     Joseph Malicki reported that the dbg_lvl sysfs attribute     for the megaraid_sas device driver had world-writable     permissions, permitting local users to modify logging     settings.

  - CVE-2009-4027     Lennert Buytenhek reported a race in the mac80211     subsystem that may allow remote users to cause a denial     of service (system crash) on a system connected to the     same wireless network.

  - CVE-2009-4536 CVE-2009-4538     Fabian Yamaguchi reported issues in the e1000 and e1000e     drivers for Intel gigabit network adapters which allow     remote users to bypass packet filters using specially     crafted ethernet frames.

  - CVE-2010-0003     Andi Kleen reported a defect which allows local users to     gain read access to memory reachable by the kernel when     the print-fatal-signals option is enabled. This option     is disabled by default.

  - CVE-2010-0007     Florian Westphal reported a lack of capability checking     in the ebtables netfilter subsystem. If the ebtables     module is loaded, local users can add and modify     ebtables rules.

  - CVE-2010-0291     Al Viro reported several issues with the mmap/mremap     system calls that allow local users to cause a denial of     service (system panic) or obtain elevated privileges.

  - CVE-2010-0298 & CVE-2010-0306     Gleb Natapov discovered issues in the KVM subsystem     where missing permission checks (CPL/IOPL) permit a user     in a guest system to denial of service a guest (system     crash) or gain escalated privileges with the guest.

  - CVE-2010-0307     Mathias Krause reported an issue with the     load_elf_binary code on the amd64 flavor kernels that     allows local users to cause a denial of service (system     crash).

  - CVE-2010-0309     Marcelo Tosatti fixed an issue in the PIT emulation code     in the KVM subsystem that allows privileged users in a     guest domain to cause a denial of service (crash) of the     host system.

  - CVE-2010-0410     Sebastian Krahmer discovered an issue in the netlink     connector subsystem that permits local users to allocate     large amounts of system memory resulting in a denial of     service (out of memory).

  - CVE-2010-0415     Ramon de Carvalho Valle discovered an issue in the     sys_move_pages interface, limited to amd64, ia64 and     powerpc64 flavors in Debian. Local users can exploit     this issue to cause a denial of service (system crash)     or gain access to sensitive kernel memory.

This kernel update for openSUSE 11.0 fixes some bugs and several security problems.

The following security issues are fixed: CVE-2009-4536:
drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.

CVE-2009-4538: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets.

CVE-2010-0007: Missing CAP_NET_ADMIN checks in the ebtables netfilter code might have allowed local attackers to modify bridge firewall settings.

CVE-2010-0003: An information leakage on fatal signals on x86_64 machines was fixed.

CVE-2009-4138: drivers/firewire/ohci.c in the Linux kernel, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains zero in the payload-length field.

CVE-2009-4308: The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.

CVE-2009-3939: The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

CVE-2009-4021: The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow attackers to cause a denial of service (invalid pointer dereference and OOPS) via vectors possibly related to a memory-consumption attack.

CVE-2009-3547: A race condition in the pipe(2) systemcall could be used by local attackers to hang the machine. The kernel in Moblin 2.0 uses NULL ptr protection which avoids code execution possbilities.

CVE-2009-2903: Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp'N' device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.

CVE-2009-3621: net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.

CVE-2009-3612: The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.

CVE-2009-3620: The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.

CVE-2009-3726: The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.

CVE-2009-3286: NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails.

CVE-2009-2910: arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.

CVE-2009-3238: The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to 'return the same value over and over again for long stretches of time.'

CVE-2009-2848: The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.

CVE-2009-3002: The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket, related to the econet_getname function in net/econet/af_econet.c; (4) an AF_NETROM socket, related to the nr_getname function in net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket, related to the raw_getname function in net/can/raw.c.

CVE-2009-1633: Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.

The Linux kernel for openSUSE 11.2 was updated to 2.6.31.12 to fix the following bugs and security issues :

  - The permission of the devtmpfs root directory was     incorrectly 1777 (instead of 755). If it was used, local     attackers could escalate privileges. (openSUSE 11.2 does     not use this filesystem by default). (CVE-2010-0299)

  - The poll_mode_io file for the megaraid_sas driver in the     Linux kernel 2.6.31.6 and earlier has world-writable     permissions, which allows local users to change the I/O     mode of the driver by modifying this file.
    (CVE-2009-3939)

  - ebtables was lacking a CAP_NET_ADMIN check, making it     possible for local unprivileged attackers to modify the     network bridge management. (CVE-2010-0007)

  - An information leakage on fatal signals on x86_64     machines was fixed. (CVE-2010-0003)

  - A race condition in fasync handling could be used by     local attackers to crash the machine or potentially     execute code. (CVE-2009-4141)

  - The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the     Linux kernel before 2.6.32.4, when network namespaces     are enabled, allows remote attackers to cause a denial     of service (NULL pointer dereference) via an invalid     IPv6 jumbogram. (CVE-2010-0006)

  - drivers/net/e1000/e1000_main.c in the e1000 driver in     the Linux kernel 2.6.32.3 and earlier handles Ethernet     frames that exceed the MTU by processing certain     trailing payload data as if it were a complete frame,     which allows remote attackers to bypass packet filters     via a large packet with a crafted payload.
    (CVE-2009-4536)

  - drivers/net/e1000e/netdev.c in the e1000e driver in the     Linux kernel 2.6.32.3 and earlier does not properly     check the size of an Ethernet frame that exceeds the     MTU, which allows remote attackers to have an     unspecified impact via crafted packets. (CVE-2009-4538)

Amerigo Wang and Eric Sesterhenn discovered that the HFS and ext4 filesystems did not correctly check certain disk structures. If a user were tricked into mounting a specially crafted filesystem, a remote attacker could crash the system or gain root privileges.
(CVE-2009-4020, CVE-2009-4308)

It was discovered that FUSE did not correctly check certain requests.
A local attacker with access to FUSE mounts could exploit this to crash the system or possibly gain root privileges. Ubuntu 9.10 was not affected. (CVE-2009-4021)

It was discovered that KVM did not correctly decode certain guest instructions. A local attacker in a guest could exploit this to trigger high scheduling latency in the host, leading to a denial of service. Ubuntu 6.06 was not affected. (CVE-2009-4031)

It was discovered that the OHCI fireware driver did not correctly handle certain ioctls. A local attacker could exploit this to crash the system, or possibly gain root privileges. Ubuntu 6.06 was not affected. (CVE-2009-4138)

Tavis Ormandy discovered that the kernel did not correctly handle O_ASYNC on locked files. A local attacker could exploit this to gain root privileges. Only Ubuntu 9.04 and 9.10 were affected.
(CVE-2009-4141)

Neil Horman and Eugene Teo discovered that the e1000 and e1000e network drivers did not correctly check the size of Ethernet frames.
An attacker on the local network could send specially crafted traffic to bypass packet filters, crash the system, or possibly gain root privileges. (CVE-2009-4536, CVE-2009-4538)

It was discovered that 'print-fatal-signals' reporting could show arbitrary kernel memory contents. A local attacker could exploit this, leading to a loss of privacy. By default this is disabled in Ubuntu and did not affect Ubuntu 6.06. (CVE-2010-0003)

Olli Jarva and Tuomo Untinen discovered that IPv6 did not correctly handle jumbo frames. A remote attacker could exploit this to crash the system, leading to a denial of service. Only Ubuntu 9.04 and 9.10 were affected. (CVE-2010-0006)

Florian Westphal discovered that bridging netfilter rules could be modified by unprivileged users. A local attacker could disrupt network traffic, leading to a denial of service. (CVE-2010-0007)

Al Viro discovered that certain mremap operations could leak kernel memory. A local attacker could exploit this to consume all available memory, leading to a denial of service. (CVE-2010-0291).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	high
68014	Oracle Linux 5 : kernel (ELSA-2010-0147)	Nessus	Oracle Linux Local Security Checks	high
68013	Oracle Linux 4 : kernel (ELSA-2010-0146)	Nessus	Oracle Linux Local Security Checks	high
60749	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60748	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	high
47202	Fedora 11 : kernel-2.6.30.10-105.2.4.fc11 (2010-0919)	Nessus	Fedora Local Security Checks	high
46270	RHEL 5 : kernel (RHSA-2010:0147)	Nessus	Red Hat Local Security Checks	high
46269	RHEL 4 : kernel (RHSA-2010:0146)	Nessus	Red Hat Local Security Checks	high
45092	CentOS 5 : kernel (CESA-2010:0147)	Nessus	CentOS Local Security Checks	high
45091	CentOS 4 : kernel (CESA-2010:0146)	Nessus	CentOS Local Security Checks	high
44966	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 2040 / 2043 / 2044)	Nessus	SuSE Local Security Checks	critical
44964	openSUSE Security Update : kernel (kernel-2050)	Nessus	SuSE Local Security Checks	critical
44951	Debian DSA-2005-1 : linux-2.6.24 - privilege escalation/denial of service/sensitive memory leak	Nessus	Debian Local Security Checks	critical
44860	Debian DSA-1996-1 : linux-2.6 - privilege escalation/denial of service/sensitive memory leak	Nessus	Debian Local Security Checks	critical
44621	openSUSE Security Update : kernel (kernel-1908)	Nessus	SuSE Local Security Checks	critical
44411	SuSE 11.2 Security Update: kernel (2010-01-28)	Nessus	SuSE Local Security Checks	critical
44399	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : linux, linux-source-2.6.15 vulnerabilities (USN-894-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2010-0003

medium

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical