--===============3409822144468449901==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="YiEDa0DAkWCtVeE4"
Content-Disposition: inline


--YiEDa0DAkWCtVeE4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-1146-1
June 09, 2011

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 8.04 LTS

Summary:

Multiple flaws fixed in the Linux kernel.

Software Description:
- linux: Linux kernel

Details:

Kees Cook discovered that some ethtool functions did not correctly clear
heap memory. A local attacker with CAP_NET_ADMIN privileges could exploit
this to read portions of kernel heap memory, leading to a loss of privacy.
(CVE-2010-4655)

Kees Cook discovered that the IOWarrior USB device driver did not correctly
check certain size fields. A local attacker with physical access could plug
in a specially crafted USB device to crash the system or potentially gain
root privileges. (CVE-2010-4656)

Goldwyn Rodrigues discovered that the OCFS2 filesystem did not correctly
clear memory when writing certain file holes. A local attacker could
exploit this to read uninitialized data from the disk, leading to a loss of
privacy. (CVE-2011-0463)

Jens Kuehnel discovered that the InfiniBand driver contained a race
condition. On systems using InfiniBand, a local attacker could send
specially crafted requests to crash the system, leading to a denial of
service. (CVE-2011-0695)

Rafael Dominguez Vega discovered that the caiaq Native Instruments USB
driver did not correctly validate string lengths. A local attacker with
physical access could plug in a specially crafted USB device to crash the
system or potentially gain root privileges. (CVE-2011-0712)

Timo Warns discovered that LDM partition parsing routines did not correctly
calculate block counts. A local attacker with physical access could plug in
a specially crafted block device to crash the system, leading to a denial
of service. (CVE-2011-1012)

Timo Warns discovered that the LDM disk partition handling code did not
correctly handle certain values. By inserting a specially crafted disk
device, a local attacker could exploit this to gain root privileges.
(CVE-2011-1017)

Tavis Ormandy discovered that the pidmap function did not correctly handle
large requests. A local attacker could exploit this to crash the system,
leading to a denial of service. (CVE-2011-1593)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 8.04 LTS:
  linux-image-2.6.24-29-386       2.6.24-29.90
  linux-image-2.6.24-29-generic   2.6.24-29.90
  linux-image-2.6.24-29-hppa32    2.6.24-29.90
  linux-image-2.6.24-29-hppa64    2.6.24-29.90
  linux-image-2.6.24-29-itanium   2.6.24-29.90
  linux-image-2.6.24-29-lpia      2.6.24-29.90
  linux-image-2.6.24-29-lpiacompat  2.6.24-29.90
  linux-image-2.6.24-29-mckinley  2.6.24-29.90
  linux-image-2.6.24-29-openvz    2.6.24-29.90
  linux-image-2.6.24-29-powerpc   2.6.24-29.90
  linux-image-2.6.24-29-powerpc-smp  2.6.24-29.90
  linux-image-2.6.24-29-powerpc64-smp  2.6.24-29.90
  linux-image-2.6.24-29-rt        2.6.24-29.90
  linux-image-2.6.24-29-server    2.6.24-29.90
  linux-image-2.6.24-29-sparc64   2.6.24-29.90
  linux-image-2.6.24-29-sparc64-smp  2.6.24-29.90
  linux-image-2.6.24-29-virtual   2.6.24-29.90
  linux-image-2.6.24-29-xen       2.6.24-29.90

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  CVE-2010-4655, CVE-2010-4656, CVE-2011-0463, CVE-2011-0695,
  CVE-2011-0712, CVE-2011-1012, CVE-2011-1017, CVE-2011-1593

Package Information:
  https://launchpad.net/ubuntu/+source/linux/2.6.24-29.90


--YiEDa0DAkWCtVeE4
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Kees Cook <kees@outflux.net>

iQIcBAEBCgAGBQJN8S9/AAoJEIly9N/cbcAm/lkQAI0AN+AplijxlsF1niabjYYM
K0MHhSQoQGNLq5OxtDXj6djc4esP4VO5C1auC9C1chaXczZYcHPpBREeAxgM9E1U
UxSU1BI8mMQ6eJziqlcPoF70fUpArmNHCtVEGW6N293YqtDHfMZoh6m9jHGmoUyb
5kkHfoDpY560T8QWz9Fc8EUMWM6OaRKPt067FZwtDConNEP04wbpO2OF/kZjtupr
ol3nbndjf+ZSKJTwbgRkCG+XTGMOrr04+b/3FKAxaUANQgpSM6ypThA0NzrIbscp
xYYL1e0xJbJyg43K7mndsg+pa3r8e5s8f1gZBSe/3onfyCQuoLJWzS6/kPO78kRt
nDduooo+lJB9DvAuelxTjDkS8pP7PLRoMnbDtJ+0VmGb04kbxq3A5xChmGfy6+hx
Ah2IzvoOZZjUVAWU9MmG5vJuMnY7fFSCmZAnZyV/JCbdO8ATcb2XlNqNNH92jDwi
ddmQH0/jw3ucRVK7lkFgfaGON/y8gpGUANWmy+Vl1fJ2641WTurBNY1Gbu9BYViZ
uXgneZp3Z1OdmT65bX6yl/qURrnvKkVz4aiTnYVklMFqzYBeecfpVr42WtM7HSz0
7o/kSEjnotxTMXcwMdCESiv3YtW5Orr/ZdGm9nxgg/hlal1zK2wVmNgihKsoBJ/v
8CZ6zlEj+gqZQsXAKm6f
=9p18
-----END PGP SIGNATURE-----

--YiEDa0DAkWCtVeE4--


--===============3409822144468449901==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============3409822144468449901==--