New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 8.9
SynopsisThe remote SuSE 9 host is missing a security-related patch.
DescriptionThis updates the SUSE Linux Enterprise Server 9 kernel to fix various security issues and some bugs.
The following security bugs were fixed :
- Incorrect buffer handling in the biarch-compat buffer handling could be used by local attackers to gain root privileges. This problem affects foremost x86_64, or potentially other biarch platforms, like PowerPC and S390x. (CVE-2010-3081)
- A kernel information leak via the WEXT ioctl was fixed.
- A kernel information leak via the XFS filesystem was fixed. (CVE-2010-3078)
- A kernel information leak in the net eql code was fixed.
- The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel did not properly check the file descriptors passed to the SWAPEXT ioctl, which allowed local users to leverage write access and obtain read access by swapping one file into another file. (CVE-2010-2226)
- Fixed a kernel information leak in the net scheduler code. (CVE-2010-2942)
- fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel allowed remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions. (CVE-2010-2248)
Additionally a data corruption bug in s390 was fixed :
- A race between /proc/pid/stat and fork in the S390 kernel could lead to data corruption.
SolutionApply YOU patch number 12646.