[kernel] r5092 - patch-tracking

[Moritz Muehlenhoff]

Author: jmm-guest
Date: Mon Dec 26 01:26:20 2005
New Revision: 5092

Added:
   patch-tracking/CVE-2004-0496
   patch-tracking/CVE-2004-0626
Modified:
   patch-tracking/CVE-2005-3623
Log:
- one relatively obscure issue that might possibly affect Sarge
- one iptables issue that is already resolved


Added: patch-tracking/CVE-2004-0496
==============================================================================
--- (empty file)
+++ patch-tracking/CVE-2004-0496	Mon Dec 26 01:26:20 2005
@@ -0,0 +1,22 @@
+Candidate: CVE-2004-0496
+References: 
+ http://www.novell.com/linux/security/advisories/2004_20_kernel.html
+ http://xforce.iss.net/xforce/xfdb/16625
+Description: 
+ Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain
+ privileges or access kernel memory, a different set of vulnerabilities than
+ those identified in CVE-2004-0495, as found by the Sparse source code checking
+ tool. 
+Notes: 
+Bugs: 
+upstream: 
+linux-2.6:
+2.6.8-sarge-security: 
+2.4.27-sarge-security: 
+2.6.8: 
+2.4.19-woody-security: 
+2.4.18-woody-security: 
+2.4.17-woody-security: 
+2.4.16-woody-security: 
+2.4.17-woody-security-hppa: 
+2.4.17-woody-security-ia64: 

Added: patch-tracking/CVE-2004-0626
==============================================================================
--- (empty file)
+++ patch-tracking/CVE-2004-0626	Mon Dec 26 01:26:20 2005
@@ -0,0 +1,28 @@
+Candidate: CVE-2004-0626
+References: 
+ http://marc.theaimsgroup.com/?l=bugtraq&m=108861141304495&w=2
+ http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000852
+ http://lwn.net/Articles/91964/
+ http://www.gentoo.org/security/en/glsa/glsa-200407-12.xml
+ http://www.novell.com/linux/security/advisories/2004_20_kernel.html
+ http://xforce.iss.net/xforce/xfdb/16554
+Description: 
+ The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6,
+ when using iptables and TCP options rules, allows remote attackers to cause a
+ denial of service (CPU consumption by infinite loop) via a large option length
+ that produces a negative integer after a casting operation to the char type.
+Notes:
+ jmm> The bug was introduced during a rewrite of the code that accesses the skb's
+ jmm> during earlier 2.6 kernels. 2.4 has the correct u_int8_t declaration.
+Bugs: 
+upstream: released (2.6.8)
+linux-2.6: N/A
+2.6.8-sarge-security: N/A
+2.4.27-sarge-security: N/A
+2.6.8: N/A
+2.4.19-woody-security: N/A
+2.4.18-woody-security: N/A
+2.4.17-woody-security: N/A
+2.4.16-woody-security: N/A
+2.4.17-woody-security-hppa: N/A
+2.4.17-woody-security-ia64: N/A

Modified: patch-tracking/CVE-2005-3623
==============================================================================
--- patch-tracking/CVE-2005-3623	(original)
+++ patch-tracking/CVE-2005-3623	Mon Dec 26 01:26:20 2005
@@ -8,7 +8,7 @@
 Notes: 
 Bugs: 
 upstream: 
-linux-2.6: pending (2.6.14.5)
+linux-2.6: pending (2.6.14.5), released (2.6.15-pre7)
 2.6.8-sarge-security: 
 2.4.27-sarge-security: 
 2.6.8: