Product : Fedora Core 3
Name : kernel
Version : 2.6.11
Release : 1.14_FC3
Summary : The Linux kernel (the core of the Linux operating system)
Description :
The kernel package contains the Linux kernel (vmlinuz), the core of any
Linux operating system. The kernel handles the basic functions
of the operating system: memory allocation, process allocation, device
input and output, etc.
This update rebases the kernel to the latest upstream stable release,
which fixes a number of security issues. Notably:
- CAN-2005-0210 : dst leak
- CAN-2005-0384 : ppp dos
- CAN-2005-0531 : Sign handling issues.
- CAN-2005-0400 : EXT2 information leak.
- CAN-2005-0449 : Remote oops.
- CAN-2005-0736 : Epoll overflow
- CAN-2005-0749 : ELF loader may kfree wrong memory.
- CAN-2005-0750 : Missing range checking in bluetooth
- CAN-2005-0767 : drm race in radeon
- CAN-2005-0815 : Corrupt isofs images could cause oops
Additionally, a large number of improvements have come from the
2.6.10 -> 2.6.11 transition.
This update requires you are running the latest udev package, and
also (if you are using SELinux) the latest selinux policy packages.
Thu Apr 7 2005 Dave Jones <davej@redhat.com>
Update to 2.6.11.7
Set CFQ as default elevator again.
Tue Apr 5 2005 Dave Jones <davej@redhat.com>
Disable slab debug.
Re-add the pwc driver. (#152593)
Wed Mar 30 2005 Dave Jones <davej@redhat.com>
x86_64: Only free PMDs and PUDs after other CPUs have been flushed
Sat Mar 26 2005 Dave Jones <davej@redhat.com>
Update to 2.6.11.6
Tue Mar 22 2005 Dave Jones <davej@redhat.com>
Fix up several calls to memset with swapped arguments.
Sat Mar 19 2005 Dave Jones <davej@redhat.com>
Update to 2.6.11.5
Fri Mar 18 2005 Dave Jones <davej@redhat.com>
Kjournald oops race. (#146344)
Tue Mar 15 2005 Dave Jones <davej@redhat.com>
Update to 2.6.11.4
Thu Mar 10 2005 Dave Jones <davej@redhat.com>
Update to 2.6.11.2
Reenable advansys driver for x86
Fri Mar 4 2005 Dave Jones <davej@redhat.com>
Fix up ACPI vs keyboard controller problem.
Fix up Altivec usage on PPC/PPC64.
Fri Mar 4 2005 Dave Jones <davej@redhat.com>
Finger the programs that try to read from /dev/mem.
New ways of bypassing Smarty's "Template security" were found and
fixed in Smarty. Users making use of that feature are encouraged
to upgrade to version 2.6.9.
A vulnerability has been discovered within the regex_replace modifier
of the Smarty templates when allowing access to untrusted users.
Furthermore, it was possible to call functions from {if} statements and
{math} functions.
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate
input to the "convcharset" variable, rendering it vulnerable to
cross-site scripting attacks.
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
The problem can be corrected by upgrading the affected package to
version 2.6.8.1-16.14. You need to reboot the computer after doing a
standard system upgrade to effect the necessary changes.
Details follow:
Alexander Nyberg discovered an integer overflow in the
sysfs_write_file() function. A local attacker could exploit this to
crash the kernel or possibly even execute arbitrary code with root
privileges by writing to an user-writable file in /sys under certain
low-memory conditions. However, there are very few cases where a
user-writeable sysfs file actually exists. (CAN-2005-0867)
Olof Johansson discovered a Denial of Service vulnerability in the
futex functions, which provide semaphores for exclusive locking of
resources. A local attacker could possibly exploit this to cause a
kernel deadlock. (CAN-2005-0937)
