[Bug 795418] Re: CVE-2011-1577

2011-12-21 Thread Paolo Pisati 
** Changed in: linux-ti-omap4 (Ubuntu Precise)
   Status: Fix Committed = Fix Released

** Changed in: linux-ti-omap4 (Ubuntu Oneiric)
   Status: Fix Committed = Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-10-25 Thread Marc Deslauriers 
** Changed in: linux-lts-backport-oneiric (Ubuntu Oneiric)
   Status: New = Invalid

** Changed in: linux-lts-backport-oneiric (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-oneiric (Ubuntu Lucid)
   Status: New = Invalid

** Changed in: linux-lts-backport-oneiric (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-oneiric (Ubuntu Precise)
   Status: New = Invalid

** Changed in: linux-lts-backport-oneiric (Ubuntu Precise)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-oneiric (Ubuntu Hardy)
   Status: New = Invalid

** Changed in: linux-lts-backport-oneiric (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-oneiric (Ubuntu Maverick)
   Status: New = Invalid

** Changed in: linux-lts-backport-oneiric (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-oneiric (Ubuntu Natty)
   Status: New = Invalid

** Changed in: linux-lts-backport-oneiric (Ubuntu Natty)
   Importance: Undecided = Medium

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-10-14 Thread Marc Deslauriers 
** Also affects: linux (Ubuntu Precise)
   Importance: Medium
   Status: Fix Released

** Also affects: linux-ec2 (Ubuntu Precise)
   Importance: Medium
   Status: Invalid

** Also affects: linux-fsl-imx51 (Ubuntu Precise)
   Importance: Medium
   Status: Invalid

** Also affects: linux-lts-backport-maverick (Ubuntu Precise)
   Importance: Medium
   Status: Invalid

** Also affects: linux-lts-backport-natty (Ubuntu Precise)
   Importance: Medium
   Status: Invalid

** Also affects: linux-mvl-dove (Ubuntu Precise)
   Importance: Medium
   Status: Invalid

** Also affects: linux-ti-omap4 (Ubuntu Precise)
   Importance: Medium
   Status: Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-09-29 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux - 2.6.32-34.77

---
linux (2.6.32-34.77) lucid-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
- LP: #849228

  [ Upstream Kernel Changes ]

  * Revert drm/i915: Remove BUG_ON from i915_gem_evict_something
  * Revert drm/i915: Periodically flush the active lists and requests
  * Revert drm/i915/evict: Ensure we completely cleanup on failure
  * Revert drm/i915: Maintain LRU order of inactive objects upon access by
CPU (v2)
  * Revert drm/i915: Implement fair lru eviction across both rings. (v2)
  * Revert drm/i915: Move the eviction logic to its own file.
  * Revert drm/i915: prepare for fair lru eviction

linux (2.6.32-34.76) lucid-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
- LP: #836914

  [ Upstream Kernel Changes ]

  * Revert drm/nv50-nvc0: work around an evo channel hang that some people
see
  * Revert eCryptfs: Handle failed metadata read in lookup
  * Revert tunnels: fix netns vs proto registration ordering

linux (2.6.32-34.75) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
- LP: #832332

  [ Upstream Kernel Changes ]

  * drm/i915: Remove BUG_ON from i915_gem_evict_something
- LP: #828550

linux (2.6.32-34.74) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
- LP: #828375

  [ Upstream Kernel Changes ]

  * proc: fix oops on invalid /proc/pid/maps access, CVE-2011-1020
- LP: #813026
- CVE-2011-1020

linux (2.6.32-34.73) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
- LP: #824148

  [ Tim Gardner ]

  * SAUCE: rtl8192se: Force a build for a 2.6/3.0 kernel
- LP: #805494
  * [Config] Add enic/fnic to udebs
- LP: #801610

  [ Upstream Kernel Changes ]

  * tty: icount changeover for other main devices, CVE-2010-4076,
CVE-2010-4077
- LP: #720189
- CVE-2010-4077
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * ftrace: Only update the function code on write to filter files
- LP: #802383
  * kmemleak: Do not return a pointer to an object that kmemleak did not
get
- LP: #802383
  * CPU hotplug, re-create sysfs directory and symlinks
- LP: #802383
  * Fix memory leak in cpufreq_stat
- LP: #802383
  * powerpc/kexec: Fix memory corruption from unallocated slaves
- LP: #802383
  * powerpc/oprofile: Handle events that raise an exception without
overflowing
- LP: #802383
  * mtd: mtdconcat: fix NAND OOB write
- LP: #802383
  * x86, 64-bit: Fix copy_[to/from]_user() checks for the userspace address
limit
- LP: #802383
  * ext3: Fix fs corruption when make_indexed_dir() fails
- LP: #802383
  * jbd: Fix forever sleeping process in do_get_write_access()
- LP: #802383
  * jbd: fix fsync() tid wraparound bug
- LP: #802383
  * ext4: release page cache in ext4_mb_load_buddy error path
- LP: #802383
  * Fix Ultrastor asm snippet
- LP: #802383
  * x86, amd: Do not enable ARAT feature on AMD processors below family
0x12
- LP: #802383
  * x86, amd: Use _safe() msr access for GartTlbWlk disable code
- LP: #802383
  * rcu: Fix unpaired rcu_irq_enter() from locking selftests
- LP: #802383
  * staging: usbip: fix wrong endian conversion
- LP: #802383
  * Fix for buffer overflow in ldm_frag_add not sufficient
- LP: #802383
  * seqlock: Don't smp_rmb in seqlock reader spin loop
- LP: #802383
  * ALSA: HDA: Use one dmic only for Dell Studio 1558
- LP: #731706, #802383
  * ASoC: Ensure output PGA is enabled for line outputs in wm_hubs
- LP: #802383
  * ASoC: Add some missing volume update bit sets for wm_hubs devices
- LP: #802383
  * mm/page_alloc.c: prevent unending loop in __alloc_pages_slowpath()
- LP: #802383
  * loop: limit 'max_part' module param to DISK_MAX_PARTS
- LP: #802383
  * loop: handle on-demand devices correctly
- LP: #802383
  * USB: CP210x Add 4 Device IDs for AC-Services Devices
- LP: #802383
  * USB: moto_modem: Add USB identifier for the Motorola VE240.
- LP: #802383
  * USB: serial: ftdi_sio: adding support for TavIR STK500
- LP: #802383
  * USB: gamin_gps: Fix for data transfer problems in native mode
- LP: #802383
  * usb/gadget: at91sam9g20 fix end point max packet size
- LP: #802383
  * usb: gadget: rndis: don't test against req-length
- LP: #802383
  * OHCI: fix regression caused by nVidia shutdown workaround
- LP: #802383
  * p54usb: add zoom 4410 usbid
- LP: #802383
  * eCryptfs: Allow 2 scatterlist entries for encrypted filenames
- LP: #802383
  * UBIFS: fix a rare memory leak in ro to rw remounting path
- LP: #802383
  * i8k: Avoid lahf in 64-bit code
- LP: #802383
  * cpuidle: menu: fixed wrapping timers at 4.294 seconds
- LP: #802383
  * dm table: reject devices without request fns
- LP: #802383
  * atm:

[Bug 795418] Re: CVE-2011-1577

2011-09-26 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux-ec2 - 2.6.32-318.38

---
linux-ec2 (2.6.32-318.38) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to 2.6.32-34.76
  * Release Tracking Bug
- LP: #837804

  [ Ubuntu: 2.6.32-34.76 ]

  * Revert drm/nv50-nvc0: work around an evo channel hang that some people
see
  * Revert eCryptfs: Handle failed metadata read in lookup
  * Revert tunnels: fix netns vs proto registration ordering

  [ Ubuntu: 2.6.32-34.75 ]

  * drm/i915: Remove BUG_ON from i915_gem_evict_something
- LP: #828550

linux-ec2 (2.6.32-318.37) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Release Tracking Bug
- LP: #829162
  * XEN: exec: delay address limit change until point of no return
- LP: #802383
  * Rebased to 2.6.32-34.74

  [ Ubuntu: 2.6.32-34.74 ]

  * proc: fix oops on invalid /proc/pid/maps access, CVE-2011-1020
- LP: #813026
- CVE-2011-1020

  [ Ubuntu: 2.6.32-34.73 ]

  * SAUCE: rtl8192se: Force a build for a 2.6/3.0 kernel
- LP: #805494
  * [Config] Add enic/fnic to udebs
- LP: #801610
  * tty: icount changeover for other main devices, CVE-2010-4076,
CVE-2010-4077
- LP: #720189
- CVE-2010-4077
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * ftrace: Only update the function code on write to filter files
- LP: #802383
  * kmemleak: Do not return a pointer to an object that kmemleak did not
get
- LP: #802383
  * CPU hotplug, re-create sysfs directory and symlinks
- LP: #802383
  * Fix memory leak in cpufreq_stat
- LP: #802383
  * powerpc/kexec: Fix memory corruption from unallocated slaves
- LP: #802383
  * powerpc/oprofile: Handle events that raise an exception without
overflowing
- LP: #802383
  * mtd: mtdconcat: fix NAND OOB write
- LP: #802383
  * x86, 64-bit: Fix copy_[to/from]_user() checks for the userspace address
limit
- LP: #802383
  * ext3: Fix fs corruption when make_indexed_dir() fails
- LP: #802383
  * jbd: Fix forever sleeping process in do_get_write_access()
- LP: #802383
  * jbd: fix fsync() tid wraparound bug
- LP: #802383
  * ext4: release page cache in ext4_mb_load_buddy error path
- LP: #802383
  * Fix Ultrastor asm snippet
- LP: #802383
  * x86, amd: Do not enable ARAT feature on AMD processors below family
0x12
- LP: #802383
  * x86, amd: Use _safe() msr access for GartTlbWlk disable code
- LP: #802383
  * rcu: Fix unpaired rcu_irq_enter() from locking selftests
- LP: #802383
  * staging: usbip: fix wrong endian conversion
- LP: #802383
  * Fix for buffer overflow in ldm_frag_add not sufficient
- LP: #802383
  * seqlock: Don't smp_rmb in seqlock reader spin loop
- LP: #802383
  * ALSA: HDA: Use one dmic only for Dell Studio 1558
- LP: #731706, #802383
  * ASoC: Ensure output PGA is enabled for line outputs in wm_hubs
- LP: #802383
  * ASoC: Add some missing volume update bit sets for wm_hubs devices
- LP: #802383
  * mm/page_alloc.c: prevent unending loop in __alloc_pages_slowpath()
- LP: #802383
  * loop: limit 'max_part' module param to DISK_MAX_PARTS
- LP: #802383
  * loop: handle on-demand devices correctly
- LP: #802383
  * USB: CP210x Add 4 Device IDs for AC-Services Devices
- LP: #802383
  * USB: moto_modem: Add USB identifier for the Motorola VE240.
- LP: #802383
  * USB: serial: ftdi_sio: adding support for TavIR STK500
- LP: #802383
  * USB: gamin_gps: Fix for data transfer problems in native mode
- LP: #802383
  * usb/gadget: at91sam9g20 fix end point max packet size
- LP: #802383
  * usb: gadget: rndis: don't test against req-length
- LP: #802383
  * OHCI: fix regression caused by nVidia shutdown workaround
- LP: #802383
  * p54usb: add zoom 4410 usbid
- LP: #802383
  * eCryptfs: Allow 2 scatterlist entries for encrypted filenames
- LP: #802383
  * UBIFS: fix a rare memory leak in ro to rw remounting path
- LP: #802383
  * i8k: Avoid lahf in 64-bit code
- LP: #802383
  * cpuidle: menu: fixed wrapping timers at 4.294 seconds
- LP: #802383
  * dm table: reject devices without request fns
- LP: #802383
  * atm: expose ATM device index in sysfs
- LP: #802383
  * brd: limit 'max_part' module param to DISK_MAX_PARTS
- LP: #802383
  * brd: handle on-demand devices correctly
- LP: #802383
  * SUNRPC: Deal with the lack of a SYN_SENT sk-sk_state_change
callback...
- LP: #802383
  * PCI: Add quirk for setting valid class for TI816X Endpoint
- LP: #802383
  * xen mmu: fix a race window causing leave_mm BUG()
- LP: #802383
  * netfilter: nf_conntrack_reasm: properly handle packets fragmented into
a single fragment
- LP: #802383
  * fix memory leak in scsi_report_lun_scan
- LP: #802383
  * fix refcounting bug in scsi_get_host_dev
- LP: #802383
  * fix duplicate removal on error path in scsi_sysfs_add_sdev

[Bug 795418] Re: CVE-2011-1577

2011-09-21 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux-ti-omap4 - 2.6.38-1209.15

---
linux-ti-omap4 (2.6.38-1209.15) natty-proposed; urgency=low

  * Release tracking bug
- LP: #837761

  [ Paolo Pisati ]

  * [Config] Turn on CONFIG_USER_NS and DEVPTS_MULTIPLE_INSTANCES.
- LP: #787749

  [ Tim Gardner ]

  * [Config] Add enic/fnic to nic-modules udeb, CVE-2011-1020
- LP: #801610

  [ Upstream Kernel Changes ]

  * mpt2sas: prevent heap overflows and unchecked reads
- LP: #780546
  * agp: fix arbitrary kernel memory writes
- LP: #775809
  * can: add missing socket check in can/raw release
- LP: #780546
  * agp: fix OOM and buffer overflow
- LP: #775809
  * bonding: Incorrect TX queue offset, CVE-2011-1581
- LP: #792312
- CVE-2011-1581
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * can: Add missing socket check in can/bcm release.
- LP: #796502
- CVE-2011-1598
  * USB: ehci: remove structure packing from ehci_def
- LP: #791552
  * taskstats: don't allow duplicate entries in listener mode,
CVE-2011-2484
- LP: #806390
- CVE-2011-2484
  * ext4: init timer earlier to avoid a kernel panic in __save_error_info,
CVE-2011-2493
- LP: #806929
- CVE-2011-2493
  * dccp: handle invalid feature options length, CVE-2011-1770
- LP: #806375
- CVE-2011-1770
  * pagemap: close races with suid execve, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * report errors in /proc/*/*map* sanely, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * close race in /proc/*/environ, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * auxv: require the target to be tracable (or yourself), CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * deal with races in /proc/*/{syscall, stack, personality}, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * rose: Add length checks to CALL_REQUEST parsing, CVE-2011-1493
- LP: #816550
- CVE-2011-1493
  * GFS2: make sure fallocate bytes is a multiple of blksize, CVE-2011-2689
- LP: #819572
- CVE-2011-2689
  * Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace.
- LP: #819569
- CVE-2011-2492
  * Add mount option to check uid of device being mounted = expect uid,
CVE-2011-1833
- LP: #732628
- CVE-2011-1833
  * ipv6: make fragment identifications less predictable, CVE-2011-2699
- LP: #827685
- CVE-2011-2699
  * perf: Fix software event overflow, CVE-2011-2918
- LP: #834121
- CVE-2011-2918
  * proc: fix oops on invalid /proc/pid/maps access, CVE-2011-1020
- LP: #813026
- CVE-2011-1020

linux-ti-omap4 (2.6.38-1209.13) natty; urgency=low

  [ Tim Gardner ]

  * Release Tracking Bug
- LP: #772381

  [ Brad Figg ]

  * Ubuntu-2.6.38-9.43

  [ Bryan Wu ]

  * merge Ubuntu-2.6.38-9.43
  * cherry-pick 6 patches from u2 of 'for-ubuntu' branch
  * [Config] Sync up configs for 2.6.38.4

  [ Herton Ronaldo Krzesinski ]

  * SAUCE: Revert x86, hibernate: Initialize mmu_cr4_features during boot
- LP: #764758

  [ Leann Ogasawara ]

  * [Config] updateconfigs for 2.6.38.4

  [ Paolo Pisati ]

  * [Config] s/USB_MUSB_TUSB6010/USB_MUSB_OMAP2PLUS/ on omap3 to get musb
- LP: #759913

  [ Serge E. Hallyn ]

  * SAUCE: kvm: fix push of wrong eip when doing softint
- LP: #747090

  [ Tim Gardner ]

  * [Config] Add cachefiles.ko to virtual flavour
- LP: #770430

  [ Upstream Kernel Changes ]

  * Revert net/sunrpc: Use static const char arrays
- LP: #761134
  * Revert x86: Cleanup highmap after brk is concluded
- LP: #761134
  * ALSA: hda - Fix SPDIF out regression on ALC889
- LP: #761134
  * ALSA: Fix yet another race in disconnection
- LP: #761134
  * ALSA: vmalloc buffers should use normal mmap
- LP: #761134
  * perf: Better fit max unprivileged mlock pages for tools needs
- LP: #761134
  * myri10ge: fix rmmod crash
- LP: #761134
  * cciss: fix lost command issue
- LP: #761134
  * ath9k: Fix kernel panic in AR2427
- LP: #761134
  * sound/oss/opl3: validate voice and channel indexes
- LP: #761134
  * mac80211: initialize sta-last_rx in sta_info_alloc
- LP: #761134
  * ses: show devices for enclosures with no page 7
- LP: #761134
  * ses: Avoid kernel panic when lun 0 is not mapped
- LP: #761134
  * PCI/ACPI: Report ASPM support to BIOS if not disabled from command line
- LP: #761134
  * eCryptfs: Unlock page in write_begin error path
- LP: #761134
  * eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix
- LP: #761134
  * crypto: aesni-intel - fixed problem with packets that are not multiple
of 64bytes
- LP: #761134
  * staging: usbip: bugfixes related to kthread conversion
- LP: #761134
  * staging: usbip: bugfix add number of packets for isochronous frames
- LP: #761134
  * staging: usbip: bugfix for isochronous packets and optimization
- LP: #761134
  * staging: hv: use

[Bug 795418] Re: CVE-2011-1577

2011-09-19 Thread Marc Deslauriers 
** Changed in: linux-mvl-dove (Ubuntu Maverick)
   Status: Fix Committed = Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-09-13 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux-fsl-imx51 - 2.6.31-610.28

---
linux-fsl-imx51 (2.6.31-610.28) lucid-proposed; urgency=low

  * Release tracking bug
- LP: #837802

  [ Upstream Kernel Changes ]

  * ipv6: make fragment identifications less predictable, CVE-2011-2699
- LP: #827685
- CVE-2011-2699
  * perf: Fix software event overflow, CVE-2011-2918
- LP: #834121
- CVE-2011-2918
  * proc: fix oops on invalid /proc/pid/maps access, CVE-2011-1020
- LP: #813026
- CVE-2011-1020

linux-fsl-imx51 (2.6.31-610.27) lucid-proposed; urgency=low

  * Release tracking bug
- LP: #829160

  [ Upstream Kernel Changes ]

  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * Fix corrupted OSF partition table parsing
- LP: #796606
- CVE-2011-1163
  * can: Add missing socket check in can/bcm release.
- LP: #796502
- CVE-2011-1598
  * proc: protect mm start_code/end_code in /proc/pid/stat
- LP: #799906
- CVE-2011-0726
  * sctp: Fix a race between ICMP protocol unreachable and connect()
  * tty: Make tiocgicount a handler, CVE-2010-4076, CVE-2010-4077
- LP: #794034
- CVE-2010-4077
  * filter: make sure filters dont read uninitialized memory CVE-2010-4158
- LP: #721282
- CVE-2010-4158
  * bio: take care not overflow page count when mapping/copying user data
CVE-2010-4162
- LP: #721441
- CVE-2010-4162
  * block: check for proper length of iov entries in blk_rq_map_user_iov()
- LP: #721504
- CVE-2010-4163
  * block: check for proper length of iov entries earlier in
blk_rq_map_user_iov(), CVE-2010-4163
- LP: #721504
- CVE-2010-4163
  * rds: Integer overflow in RDS cmsg handling, CVE-2010-4175
- LP: #721455
- CVE-2010-4175
  * bluetooth: Fix missing NULL check CVE-2010-4242
- LP: #714846
- CVE-2010-4242
  * IB/uverbs: Handle large number of entries in poll CQ CVE-2010-4649
- LP: #800121
- CVE-2010-4649
  * epoll: prevent creating circular epoll structures CVE-2011-1082
- LP: #800758
- CVE-2011-1082
  * nfs4: Ensure that ACL pages sent over NFS were not allocated from the
slab (v3) CVE-2011-1090
- LP: #800775
  * ldm: corrupted partition table can cause kernel oops CVE-2011-1012
- LP: #801083
- CVE-2011-1012
  * netfilter: ipt_CLUSTERIP: fix buffer overflow CVE-2011-2534
- LP: #801473
- CVE-2011-2534
  * netfilter: arp_tables: fix infoleak to userspace CVE-2011-1170
- LP: #801480
- CVE-2011-1170
  * netfilter: ip_tables: fix infoleak to userspace CVE-2011-1171
- LP: #801482
- CVE-2011-1171
  * ipv6: netfilter: ip6_tables: fix infoleak to userspace CVE-2011-1172
- LP: #801483
- CVE-2011-1172
  * econet: 4 byte infoleak to the network CVE-2011-1173
- LP: #801484
- CVE-2011-1173
  * net: Limit socket I/O iovec total length to INT_MAX.
- LP: #708839
  * fs/partitions: Validate map_count in Mac partition tables -
CVE-2011-1010
- LP: #804225
- CVE-2011-1010
  * drm: fix unsigned vs signed comparison issue in modeset ctl ioctl,
CVE-2011-1013
- LP: #804229
- CVE-2011-1013
  * exec: copy-and-paste the fixes into compat_do_execve() paths -
CVE-2010-4243
- LP: #804234
- CVE-2010-4243
  * taskstats: don't allow duplicate entries in listener mode,
CVE-2011-2484
- LP: #806390
- CVE-2011-2484
  * dccp: handle invalid feature options length, CVE-2011-1770
- LP: #806375
- CVE-2011-1770
  * pagemap: close races with suid execve, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * report errors in /proc/*/*map* sanely, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * close race in /proc/*/environ, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * auxv: require the target to be tracable (or yourself), CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * deal with races in /proc/*/{syscall, stack, personality}, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
  * dccp: fix oops on Reset after close, CVE-2011-1093
- LP: #814087
- CVE-2011-1093
  * net: add limit for socket backlog CVE-2010-4251
- LP: #807462
  * tcp: use limited socket backlog CVE-2010-4251
- LP: #807462
  * ipv6: udp: Optimise multicast reception
- LP: #807462
  * ipv4: udp: Optimise multicast reception
- LP: #807462
  * udp: multicast RX should increment SNMP/sk_drops counter in allocation
failures CVE-2010-4251
- LP: #807462
  * udp: use limited socket backlog CVE-2010-4251
- LP: #807462
  * llc: use limited socket backlog CVE-2010-4251
- LP: #807462
  * sctp: use limited socket backlog CVE-2010-4251
- LP: #807462
  * tipc: use limited socket backlog CVE-2010-4251
- LP: #807462
  * x25: use limited socket backlog CVE-2010-4251
- LP: #807462
  * net: backlog functions rename CVE-2010-4251
- LP: #807462
  * net: sk_add_backlog() take rmem_alloc into account CVE-2010-4805

[Bug 795418] Re: CVE-2011-1577

2011-09-13 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux-mvl-dove - 2.6.32-218.36

---
linux-mvl-dove (2.6.32-218.36) lucid-proposed; urgency=low

  * Release tracking bug
- LP: #837803

  [ Paolo Pisati ]

  * Rebased to 2.6.32-34.76

  [ Ubuntu: 2.6.32-34.76 ]

  * Release Tracking Bug
- LP: #836914
  * Revert drm/nv50-nvc0: work around an evo channel hang that some people
see
  * Revert eCryptfs: Handle failed metadata read in lookup
  * Revert tunnels: fix netns vs proto registration ordering

  [ Ubuntu: 2.6.32-34.75 ]

  * Release Tracking Bug
- LP: #832332
  * drm/i915: Remove BUG_ON from i915_gem_evict_something
- LP: #828550

linux-mvl-dove (2.6.32-218.35) lucid-proposed; urgency=low

  [ Paolo Pisati ]

  * Release Tracking Bug
- LP: #829161
  * Rebased to 2.6.32-34.74

  [ Ubuntu: 2.6.32-34.74 ]

  * Release Tracking Bug
- LP: #828375
  * proc: fix oops on invalid /proc/pid/maps access, CVE-2011-1020
- LP: #813026
- CVE-2011-1020

  [ Ubuntu: 2.6.32-34.73 ]

  * Release Tracking Bug
- LP: #824148
  * SAUCE: rtl8192se: Force a build for a 2.6/3.0 kernel
- LP: #805494
  * [Config] Add enic/fnic to udebs
- LP: #801610
  * tty: icount changeover for other main devices, CVE-2010-4076,
CVE-2010-4077
- LP: #720189
- CVE-2010-4077
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * ftrace: Only update the function code on write to filter files
- LP: #802383
  * kmemleak: Do not return a pointer to an object that kmemleak did not
get
- LP: #802383
  * CPU hotplug, re-create sysfs directory and symlinks
- LP: #802383
  * Fix memory leak in cpufreq_stat
- LP: #802383
  * powerpc/kexec: Fix memory corruption from unallocated slaves
- LP: #802383
  * powerpc/oprofile: Handle events that raise an exception without
overflowing
- LP: #802383
  * mtd: mtdconcat: fix NAND OOB write
- LP: #802383
  * x86, 64-bit: Fix copy_[to/from]_user() checks for the userspace address
limit
- LP: #802383
  * ext3: Fix fs corruption when make_indexed_dir() fails
- LP: #802383
  * jbd: Fix forever sleeping process in do_get_write_access()
- LP: #802383
  * jbd: fix fsync() tid wraparound bug
- LP: #802383
  * ext4: release page cache in ext4_mb_load_buddy error path
- LP: #802383
  * Fix Ultrastor asm snippet
- LP: #802383
  * x86, amd: Do not enable ARAT feature on AMD processors below family
0x12
- LP: #802383
  * x86, amd: Use _safe() msr access for GartTlbWlk disable code
- LP: #802383
  * rcu: Fix unpaired rcu_irq_enter() from locking selftests
- LP: #802383
  * staging: usbip: fix wrong endian conversion
- LP: #802383
  * Fix for buffer overflow in ldm_frag_add not sufficient
- LP: #802383
  * seqlock: Don't smp_rmb in seqlock reader spin loop
- LP: #802383
  * ALSA: HDA: Use one dmic only for Dell Studio 1558
- LP: #731706, #802383
  * ASoC: Ensure output PGA is enabled for line outputs in wm_hubs
- LP: #802383
  * ASoC: Add some missing volume update bit sets for wm_hubs devices
- LP: #802383
  * mm/page_alloc.c: prevent unending loop in __alloc_pages_slowpath()
- LP: #802383
  * loop: limit 'max_part' module param to DISK_MAX_PARTS
- LP: #802383
  * loop: handle on-demand devices correctly
- LP: #802383
  * USB: CP210x Add 4 Device IDs for AC-Services Devices
- LP: #802383
  * USB: moto_modem: Add USB identifier for the Motorola VE240.
- LP: #802383
  * USB: serial: ftdi_sio: adding support for TavIR STK500
- LP: #802383
  * USB: gamin_gps: Fix for data transfer problems in native mode
- LP: #802383
  * usb/gadget: at91sam9g20 fix end point max packet size
- LP: #802383
  * usb: gadget: rndis: don't test against req-length
- LP: #802383
  * OHCI: fix regression caused by nVidia shutdown workaround
- LP: #802383
  * p54usb: add zoom 4410 usbid
- LP: #802383
  * eCryptfs: Allow 2 scatterlist entries for encrypted filenames
- LP: #802383
  * UBIFS: fix a rare memory leak in ro to rw remounting path
- LP: #802383
  * i8k: Avoid lahf in 64-bit code
- LP: #802383
  * cpuidle: menu: fixed wrapping timers at 4.294 seconds
- LP: #802383
  * dm table: reject devices without request fns
- LP: #802383
  * atm: expose ATM device index in sysfs
- LP: #802383
  * brd: limit 'max_part' module param to DISK_MAX_PARTS
- LP: #802383
  * brd: handle on-demand devices correctly
- LP: #802383
  * SUNRPC: Deal with the lack of a SYN_SENT sk-sk_state_change
callback...
- LP: #802383
  * PCI: Add quirk for setting valid class for TI816X Endpoint
- LP: #802383
  * xen mmu: fix a race window causing leave_mm BUG()
- LP: #802383
  * netfilter: nf_conntrack_reasm: properly handle packets fragmented into
a single fragment
- LP: #802383
  * fix memory leak in scsi_report_lun_scan
- LP: #802383
  * fix refcounting bug in

[Bug 795418] Re: CVE-2011-1577

2011-09-13 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux-ti-omap4 - 2.6.35-903.24

---
linux-ti-omap4 (2.6.35-903.24) maverick-proposed; urgency=low

  * Release tracking bug
- LP: #838037

  [ Upstream Kernel Changes ]

  * ipv6: make fragment identifications less predictable, CVE-2011-2699
- LP: #827685
- CVE-2011-2699
  * perf: Fix software event overflow, CVE-2011-2918
- LP: #834121
- CVE-2011-2918
  * proc: fix oops on invalid /proc/pid/maps access, CVE-2011-1020
- LP: #813026
- CVE-2011-1020

linux-ti-omap4 (2.6.35-903.23) maverick-proposed; urgency=low

  * Release tracking bug
- LP: #829655

  [ Upstream Kernel Changes ]

  * drm/radeon/kms: check AA resolve registers on r300, CVE-2011-1016
- LP: #745686
- CVE-2011-1016
  * drm/radeon: fix regression with AA resolve checking, CVE-2011-1016
- LP: #745686
- CVE-2011-1016
  * can-bcm: fix minor heap overflow
- LP: #690730
  * CAN: Use inode instead of kernel address for /proc file, CVE-2010-4565
- LP: #765007
- CVE-2010-4565
  * av7110: check for negative array offset
- LP: #747520
  * xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1,
CVE-2011-0711
- LP: #767740
- CVE-2011-0711
  * ALSA: caiaq - Fix possible string-buffer overflow
- LP: #747520
  * IB/cm: Bump reference count on cm_id before invoking callback,
CVE-2011-0695
- LP: #770369
- CVE-2011-0695
  * RDMA/cma: Fix crash in request handlers, CVE-2011-0695
- LP: #770369
- CVE-2011-0695
  * Treat writes as new when holes span across page boundaries,
CVE-2011-0463
- LP: #770483
- CVE-2011-0463
  * net: clear heap allocations for privileged ethtool actions
- LP: #686158
  * usb: iowarrior: don't trust report_size for buffer size
- LP: #747520
  * fs/partitions/ldm.c: fix oops caused by corrupted partition table,
CVE-2011-1017
- LP: #771382
- CVE-2011-1017
  * Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal
code
- LP: #747520
  * Relax si_code check in rt_sigqueueinfo and rt_tgsigqueueinfo
- LP: #747520
  * exec: make argv/envp memory visible to oom-killer
- LP: #690730
  * next_pidmap: fix overflow condition
- LP: #772560
  * proc: do proper range check on readdir offset
- LP: #772560
  * ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl, CVE-2011-1169
- LP: #785331
- CVE-2011-1169
  * mpt2sas: prevent heap overflows and unchecked reads, CVE-2011-1494
- LP: #787145
- CVE-2011-1494
  * agp: fix arbitrary kernel memory writes, CVE-1011-2022
- LP: #788684
- CVE-1011-2022
  * can: add missing socket check in can/raw release, CVE-2011-1748
- LP: #788694
- CVE-2011-1748
  * agp: fix OOM and buffer overflow
- LP: #788700
  * drivers/net/cxgb3/cxgb3_main.c: prevent reading uninitialized stack
memory - CVE-2010-3296
- CVE-2010-3296
  * drivers/net/eql.c: prevent reading uninitialized stack memory -
CVE-2010-3297
- CVE-2010-3297
  * inet_diag: Make sure we actually run the same bytecode we audited,
CVE-2010-3880
- LP: #711865
- CVE-2010-3880
  * setup_arg_pages: diagnose excessive argument size - CVE-2010-3858
- LP: #672664
- CVE-2010-3858
  * net: Truncate recvfrom and sendto length to INT_MAX - CVE-2010-3859
- LP: #690730
- CVE-2010-3859
  * net: Limit socket I/O iovec total length to INT_MAX - CVE-2010-3859
- LP: #690730
- CVE-2010-3859
  * ipc: initialize structure memory to zero for compat functions -
CVE-2010-4073
- LP: #690730
- CVE-2010-4073
  * ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory -
CVE-2010-4080, CVE-2010-4081
- LP: #672664
- CVE-2010-4080, CVE-2010-4081
  * drivers/video/via/ioctl.c: prevent reading uninitialized stack memory -
CVE-2010-4082
- CVE-2010-4082
  * sys_semctl: fix kernel stack leakage, CVE-2010-4083
- LP: #712749
- CVE-2010-4083
  * gdth: integer overflow in ioctl - CVE-2010-4157
- LP: #686158
- CVE-2010-4157
  * bio: take care not overflow page count when mapping/copying user data -
CVE-2010-4162
- LP: #721441
- CVE-2010-4162
  * bluetooth: Fix missing NULL check - CVE-2010-4242
- LP: #686158
  * rds: Integer overflow in RDS cmsg handling, CVE-2010-4175
- LP: #721455
- CVE-2010-4175
  * perf_events: Fix perf_counter_mmap() hook in mprotect() - CVE-2010-4169
- LP: #690730
- CVE-2010-4169
  * block: check for proper length of iov entries in blk_rq_map_user_iov()
- CVE-2010-4163
- LP: #690730
- CVE-2010-4163
  * block: check for proper length of iov entries earlier in
blk_rq_map_user_iov(), CVE-2010-4163
- LP: #721504
- CVE-2010-4163
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * Fix corrupted OSF partition table parsing
- LP: #796606
- CVE-2011-1163
  * can: Add missing socket check in

[Bug 795418] Re: CVE-2011-1577

2011-09-01 Thread Launchpad Bug Tracker 
** Branch linked: lp:ubuntu/natty-proposed/linux-ti-omap4

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-08-24 Thread Launchpad Bug Tracker 
** Branch linked: lp:ubuntu/maverick-proposed/linux-ti-omap4

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-08-24 Thread Launchpad Bug Tracker 
** Branch linked: lp:ubuntu/lucid-proposed/linux-ec2

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-08-24 Thread Launchpad Bug Tracker 
** Branch linked: lp:ubuntu/lucid-proposed/linux-mvl-dove

** Branch linked: lp:ubuntu/maverick-proposed/linux-mvl-dove

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-08-18 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux - 2.6.38-11.48

---
linux (2.6.38-11.48) natty-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
- LP: #818175

  [ Upstream Kernel Changes ]

  * Revert HID: magicmouse: ignore 'ivalid report id' while switching
modes
- LP: #814250

linux (2.6.38-11.47) natty-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
- LP: #811180

  [ Keng-Yu Lin ]

  * SAUCE: Revert: dell-laptop: Toggle the unsupported hardware
killswitch
- LP: #775281

  [ Ming Lei ]

  * SAUCE: fix yama_ptracer_del lockdep warning
- LP: #791019

  [ Stefan Bader ]

  * SAUCE: Re-enable RODATA for i386 virtual
- LP: #809838

  [ Tim Gardner ]

  * [Config] Add grub-efi as a recommended bootloader for server and
generic
- LP: #800910
  * SAUCE: rtl8192se: Force a build for a 2.6/3.0 kernel
- LP: #805494

  [ Upstream Kernel Changes ]

  * Revert bridge: Forward reserved group addresses if !STP
- LP: #793702
  * Fix up ABI directory
  * bonding: Incorrect TX queue offset, CVE-2011-1581
- LP: #792312
- CVE-2011-1581
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * usbnet/cdc_ncm: add missing .reset_resume hook
- LP: #793892
  * ath5k: Disable fast channel switching by default
- LP: #767192
  * mm: vmscan: correctly check if reclaimer should schedule during
shrink_slab
- LP: #755066
  * mm: vmscan: correct use of pgdat_balanced in sleeping_prematurely
- LP: #755066
  * ALSA: hda - Use LPIB for ATI/AMD chipsets as default
- LP: #741825
  * ALSA: hda - Enable snoop bit for AMD controllers
- LP: #741825
  * ALSA: hda - Enable sync_write workaround for AMD generically
- LP: #741825
  * cpuidle: menu: fixed wrapping timers at 4.294 seconds
- LP: #774947
  * drm/i915: Fix gen6 (SNB) missed BLT ring interrupts.
- LP: #761065
  * USB: ehci: remove structure packing from ehci_def
- LP: #791552
  * drm/i915: disable PCH ports if needed when disabling a CRTC
- LP: #791752
  * kmemleak: Do not return a pointer to an object that kmemleak did not
get
- LP: #793702
  * kmemleak: Initialise kmemleak after debug_objects_mem_init()
- LP: #793702
  * Fix _OSC UUID in pcc-cpufreq
- LP: #793702
  * CPU hotplug, re-create sysfs directory and symlinks
- LP: #793702
  * Fix memory leak in cpufreq_stat
- LP: #793702
  * net: recvmmsg: Strip MSG_WAITFORONE when calling recvmsg
- LP: #793702
  * ftrace: Only update the function code on write to filter files
- LP: #793702
  * qla2xxx: Fix hang during driver unload when vport is active.
- LP: #793702
  * qla2xxx: Fix virtual port failing to login after chip reset.
- LP: #793702
  * qla2xxx: Fix vport delete hang when logins are outstanding.
- LP: #793702
  * powerpc/kdump64: Don't reference freed memory as pacas
- LP: #793702
  * powerpc/kexec: Fix memory corruption from unallocated slaves
- LP: #793702
  * x86, cpufeature: Fix cpuid leaf 7 feature detection
- LP: #793702
  * ath9k_hw: do noise floor calibration only on required chains
- LP: #793702
  * ath9k_hw: fix power for the HT40 duplicate frames
- LP: #793702
  * ath9k_hw: fix dual band assumption for XB113
- LP: #793702
  * ath9k_hw: Fix STA connection issues with AR9380 (XB113).
- LP: #793702
  * powerpc: Set nr_cpu_ids early and use it to free PACAs
- LP: #793702
  * powerpc/oprofile: Handle events that raise an exception without
overflowing
- LP: #793702
  * iwlagn: fix iwl_is_any_associated
- LP: #793702
  * block: rescan partitions on invalidated devices on -ENOMEDIA too
- LP: #793702
  * block: move bd_set_size() above rescan_partitions() in __blkdev_get()
- LP: #793702
  * paride: Convert to bdops-check_events()
- LP: #793702
  * gdrom,viocd: Convert to bdops-check_events()
- LP: #793702
  * ide: Convert to bdops-check_events()
- LP: #793702
  * block: don't block events on excl write for non-optical devices
- LP: #793702
  * block: Fix discard topology stacking and reporting
- LP: #793702
  * block: add proper state guards to __elv_next_request
- LP: #793702
  * block: always allocate genhd-ev if check_events is implemented
- LP: #793702
  * mtd: mtdconcat: fix NAND OOB write
- LP: #793702
  * mtd: return badblockbits back
- LP: #793702
  * x86, 64-bit: Fix copy_[to/from]_user() checks for the userspace address
limit
- LP: #793702
  * ext4: fix possible use-after-free in ext4_remove_li_request()
- LP: #793702
  * iwlwifi: fix bugs in change_interface
- LP: #793702
  * nl80211: Fix set_key regression with some drivers
- LP: #793702
  * mac80211: fix a few RCU issues
- LP: #793702
  * wire up fanotify syscalls
- LP: #793702
  * wire up clock_adjtime syscall
- LP: #793702
  * drm: Send pending vblank events before disabling vblank.

[Bug 795418] Re: CVE-2011-1577

2011-08-16 Thread Kees Cook 
** Changed in: linux-ec2 (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux-ec2 (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux-ec2 (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux-ec2 (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux-ec2 (Ubuntu Natty)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-natty (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-natty (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-natty (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-natty (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-natty (Ubuntu Natty)
   Importance: Undecided = Medium

** Changed in: linux-mvl-dove (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux-mvl-dove (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux-mvl-dove (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux-mvl-dove (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux-mvl-dove (Ubuntu Natty)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-maverick (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-maverick (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-maverick (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-maverick (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux-lts-backport-maverick (Ubuntu Natty)
   Importance: Undecided = Medium

** Changed in: linux (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux (Ubuntu Natty)
   Importance: Undecided = Medium

** Changed in: linux-ti-omap4 (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux-ti-omap4 (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux-ti-omap4 (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux-ti-omap4 (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux-ti-omap4 (Ubuntu Natty)
   Importance: Undecided = Medium

** Changed in: linux-fsl-imx51 (Ubuntu Lucid)
   Importance: Undecided = Medium

** Changed in: linux-fsl-imx51 (Ubuntu Oneiric)
   Importance: Undecided = Medium

** Changed in: linux-fsl-imx51 (Ubuntu Hardy)
   Importance: Undecided = Medium

** Changed in: linux-fsl-imx51 (Ubuntu Maverick)
   Importance: Undecided = Medium

** Changed in: linux-fsl-imx51 (Ubuntu Natty)
   Importance: Undecided = Medium

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-08-10 Thread Kees Cook 
** Description changed:

  Heap-based buffer overflow in the is_gpt_valid function in
  fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows
  physically proximate attackers to cause a denial of service (OOPS) or
  possibly have unspecified other impact via a crafted size of the EFI
  GUID partition-table header on removable media.
  
- Fixed-by: 3eb8e74ec72736b9b9d728bad30484ec89c91dde
+ Break-Fix: - 3eb8e74ec72736b9b9d728bad30484ec89c91dde

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-08-02 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux - 2.6.35-30.56

---
linux (2.6.35-30.56) maverick-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
- LP: #808934

  [ Herton Ronaldo Krzesinski ]

  * Revert SAUCE: mmc: Enable MMC card reader for RICOH [1180:e823]

  [ Upstream Kernel Changes ]

  * Revert x86: Flush TLB if PGD entry is changed in i386 PAE mode
- LP: #805209

linux (2.6.35-30.55) maverick-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
- LP: #801690

  [ Jeremy Kerr ]

  * SAUCE: cx23885: Fix argument to videobuf_dma_unmap
- LP: #800527

  [ Manoj Iyer ]

  * SAUCE: mmc: Enable MMC card reader for RICOH [1180:e823]
- LP: #790754

  [ Upstream Kernel Changes ]

  * agp: fix OOM and buffer overflow
- LP: #791918
- CVE-2011-1746
  * tty: icount changeover for other main devices, CVE-2010-4076,
CVE-2010-4077
- LP: #720189
- CVE-2010-4077
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * Fix corrupted OSF partition table parsing
- LP: #796606
- CVE-2011-1163
  * can: Add missing socket check in can/bcm release.
- LP: #796502
- CVE-2011-1598
  * nfs4: Ensure that ACL pages sent over NFS were not allocated from the
slab (v3) CVE-2011-1090
- LP: #800775
- CVE-2011-1090
 -- Herton Ronaldo Krzesinski herton.krzesin...@canonical.com   Mon, 11 Jul 
2011 15:17:32 -0300

** Changed in: linux (Ubuntu Maverick)
   Status: Fix Committed = Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1090

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1598

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-08-01 Thread Kees Cook 
** Changed in: linux-ti-omap4 (Ubuntu Oneiric)
   Status: Confirmed = Fix Committed

** Description changed:

  Heap-based buffer overflow in the is_gpt_valid function in
  fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows
  physically proximate attackers to cause a denial of service (OOPS) or
- possibly have unspecified other impact via a crafted size of the EFI GUID
- partition-table header on removable media.
+ possibly have unspecified other impact via a crafted size of the EFI
+ GUID partition-table header on removable media.
  
  Fixed-by: 3eb8e74ec72736b9b9d728bad30484ec89c91dde
- 
- 
- commit 3eb8e74ec72736b9b9d728bad30484ec89c91dde
- Author: Timo Warns wa...@pre-sense.de
- Date:   Thu May 26 16:25:57 2011 -0700
- 
- fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops
- 
- The kernel automatically evaluates partition tables of storage devices.
- The code for evaluating GUID partitions (in fs/partitions/efi.c) contains
- a bug that causes a kernel oops on certain corrupted GUID partition
- tables.
- 
- This bug has security impacts, because it allows, for example, to
- prepare a storage device that crashes a kernel subsystem upon connecting
- the device (e.g., a USB Stick of (Partial) Death).
- 
- crc = efi_crc32((const unsigned char *) (*gpt), 
le32_to_cpu((*gpt)-head
- 
- computes a CRC32 checksum over gpt covering (*gpt)-header_size bytes.
- There is no validation of (*gpt)-header_size before the efi_crc32 call.
- 
- A corrupted partition table may have large values for (*gpt)-header_size.
-  In this case, the CRC32 computation access memory beyond the memory
- allocated for gpt, which may cause a kernel heap overflow.
- 
- Validate value of GUID partition table header size.
- 
- [a...@linux-foundation.org: fix layout and indenting]
- Signed-off-by: Timo Warns wa...@pre-sense.de
- Cc: Matt Domsch matt_dom...@dell.com
- Cc: Eugene Teo eugene...@kernel.sg
- Cc: Dave Jones da...@codemonkey.org.uk
- Signed-off-by: Andrew Morton a...@linux-foundation.org
- Signed-off-by: Linus Torvalds torva...@linux-foundation.org

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-07-14 Thread Launchpad Bug Tracker 
This bug was fixed in the package linux - 2.6.24-29.91

---
linux (2.6.24-29.91) hardy-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
- LP: #801636

  [Andy Whitcroft]

  * custom binaries need VERSION_SIGNATURE updated during prepare
- LP: #794698

  [Stefan Bader]

  * (config) Disable COMPAT_VDSO for i386 Xen kernels
- LP: #794715
  * XEN: Add yield points to blktap and blkback
- LP: #791212
- CVE-2010-4247
  * xen: Fix memory corruption caused by double free
- LP: #705562

  [Upstream Kernel Changes]

  * agp: fix arbitrary kernel memory writes, CVE-1011-2022
- LP: #788684
- CVE-1011-2022
  * agp: fix OOM and buffer overflow
- LP: #791918
- CVE-2011-1746
  * tty: icount changeover for other main devices, CVE-2010-4076,
CVE-2010-4077
- LP: #794034
- CVE-2010-4077
  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
- LP: #795418
- CVE-2011-1577
  * Fix corrupted OSF partition table parsing
- LP: #796606
- CVE-2011-1163
  * proc: avoid information leaks to non-privileged processes
- LP: #799906
- CVE-2011-0726
  * proc: protect mm start_code/end_code in /proc/pid/stat
- LP: #799906
- CVE-2011-0726
  * sctp: Fix a race between ICMP protocol unreachable and connect()
- LP: #799828
- CVE-2010-4526
  * xen: blkback, blktap: Fix potential resource leak
- LP: #800254
 -- Steve Conklin sconk...@canonical.com   Fri, 24 Jun 2011 10:59:11 -0500

** Changed in: linux (Ubuntu Hardy)
   Status: Fix Committed = Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-4076

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-4077

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-4247

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-4526

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-0726

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1163

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1746

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-07-12 Thread Launchpad Bug Tracker 
** Branch linked: lp:ubuntu/lucid-proposed/linux-lts-backport-maverick

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-06-13 Thread Andy Whitcroft 
** Changed in: linux-fsl-imx51 (Ubuntu Lucid)
   Status: Confirmed = Fix Committed

** Changed in: linux-fsl-imx51 (Ubuntu Lucid)
 Assignee: (unassigned) = Andy Whitcroft (apw)

** Changed in: linux-ti-omap4 (Ubuntu Maverick)
   Status: Confirmed = Fix Committed

** Changed in: linux-ti-omap4 (Ubuntu Natty)
   Status: Confirmed = Fix Committed

** Changed in: linux (Ubuntu Hardy)
   Status: In Progress = Fix Committed

** Changed in: linux (Ubuntu Lucid)
   Status: In Progress = Fix Committed

** Changed in: linux (Ubuntu Maverick)
   Status: In Progress = Fix Committed

** Changed in: linux (Ubuntu Natty)
   Status: In Progress = Fix Committed

** Changed in: linux-ec2 (Ubuntu Lucid)
   Status: Confirmed = Fix Committed

** Changed in: linux-lts-backport-maverick (Ubuntu Lucid)
   Status: Confirmed = Fix Committed

** Changed in: linux-mvl-dove (Ubuntu Lucid)
   Status: Confirmed = Fix Committed

** Changed in: linux-mvl-dove (Ubuntu Maverick)
   Status: Confirmed = Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 795418] Re: CVE-2011-1577

2011-06-10 Thread Andy Whitcroft 
CVE-2011-1577

** Also affects: linux (Ubuntu Oneiric)
   Importance: Undecided
   Status: New

** Also affects: linux-fsl-imx51 (Ubuntu Oneiric)
   Importance: Undecided
   Status: New

** Also affects: linux-lts-backport-maverick (Ubuntu Oneiric)
   Importance: Undecided
   Status: New

** Also affects: linux-mvl-dove (Ubuntu Oneiric)
   Importance: Undecided
   Status: New

** Also affects: linux-ti-omap4 (Ubuntu Oneiric)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Natty)
   Importance: Undecided
   Status: New

** Also affects: linux-fsl-imx51 (Ubuntu Natty)
   Importance: Undecided
   Status: New

** Also affects: linux-lts-backport-maverick (Ubuntu Natty)
   Importance: Undecided
   Status: New

** Also affects: linux-mvl-dove (Ubuntu Natty)
   Importance: Undecided
   Status: New

** Also affects: linux-ti-omap4 (Ubuntu Natty)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Maverick)
   Importance: Undecided
   Status: New

** Also affects: linux-fsl-imx51 (Ubuntu Maverick)
   Importance: Undecided
   Status: New

** Also affects: linux-lts-backport-maverick (Ubuntu Maverick)
   Importance: Undecided
   Status: New

** Also affects: linux-mvl-dove (Ubuntu Maverick)
   Importance: Undecided
   Status: New

** Also affects: linux-ti-omap4 (Ubuntu Maverick)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Lucid)
   Importance: Undecided
   Status: New

** Also affects: linux-fsl-imx51 (Ubuntu Lucid)
   Importance: Undecided
   Status: New

** Also affects: linux-lts-backport-maverick (Ubuntu Lucid)
   Importance: Undecided
   Status: New

** Also affects: linux-mvl-dove (Ubuntu Lucid)
   Importance: Undecided
   Status: New

** Also affects: linux-ti-omap4 (Ubuntu Lucid)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Hardy)
   Importance: Undecided
   Status: New

** Also affects: linux-fsl-imx51 (Ubuntu Hardy)
   Importance: Undecided
   Status: New

** Also affects: linux-lts-backport-maverick (Ubuntu Hardy)
   Importance: Undecided
   Status: New

** Also affects: linux-mvl-dove (Ubuntu Hardy)
   Importance: Undecided
   Status: New

** Also affects: linux-ti-omap4 (Ubuntu Hardy)
   Importance: Undecided
   Status: New

** Changed in: linux (Ubuntu Oneiric)
   Status: New = Fix Released

** Changed in: linux-fsl-imx51 (Ubuntu Hardy)
   Status: New = Invalid

** Changed in: linux-fsl-imx51 (Ubuntu Maverick)
   Status: New = Invalid

** Changed in: linux-fsl-imx51 (Ubuntu Natty)
   Status: New = Invalid

** Changed in: linux-fsl-imx51 (Ubuntu Oneiric)
   Status: New = Invalid

** Changed in: linux-lts-backport-maverick (Ubuntu Hardy)
   Status: New = Invalid

** Changed in: linux-lts-backport-maverick (Ubuntu Maverick)
   Status: New = Invalid

** Changed in: linux-lts-backport-maverick (Ubuntu Natty)
   Status: New = Invalid

** Changed in: linux-lts-backport-maverick (Ubuntu Oneiric)
   Status: New = Invalid

** Changed in: linux-mvl-dove (Ubuntu Hardy)
   Status: New = Invalid

** Changed in: linux-mvl-dove (Ubuntu Natty)
   Status: New = Invalid

** Changed in: linux-mvl-dove (Ubuntu Oneiric)
   Status: New = Invalid

** Changed in: linux-ti-omap4 (Ubuntu Hardy)
   Status: New = Invalid

** Changed in: linux-ti-omap4 (Ubuntu Lucid)
   Status: New = Invalid

** Also affects: linux-lts-backport-natty (Ubuntu)
   Importance: Undecided
   Status: New

** Changed in: linux-lts-backport-natty (Ubuntu Hardy)
   Status: New = Invalid

** Changed in: linux-lts-backport-natty (Ubuntu Maverick)
   Status: New = Invalid

** Changed in: linux-lts-backport-natty (Ubuntu Natty)
   Status: New = Invalid

** Changed in: linux-lts-backport-natty (Ubuntu Oneiric)
   Status: New = Invalid

** Also affects: linux-ec2 (Ubuntu)
   Importance: Undecided
   Status: New

** Changed in: linux-ec2 (Ubuntu Hardy)
   Status: New = Invalid

** Changed in: linux-ec2 (Ubuntu Maverick)
   Status: New = Invalid

** Changed in: linux-ec2 (Ubuntu Natty)
   Status: New = Invalid

** Changed in: linux-ec2 (Ubuntu Oneiric)
   Status: New = Invalid

** Changed in: linux-lts-backport-natty (Ubuntu Lucid)
   Status: New = Fix Released

** Description changed:

- Placeholder
+ Heap-based buffer overflow in the is_gpt_valid function in
+ fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows
+ physically proximate attackers to cause a denial of service (OOPS) or
+ possibly have unspecified other impact via a crafted size of the EFI GUID
+ partition-table header on removable media.
+ 
+ Fixed-by: 3eb8e74ec72736b9b9d728bad30484ec89c91dde
+ 
+ 
+ commit 3eb8e74ec72736b9b9d728bad30484ec89c91dde
+ Author: Timo Warns wa...@pre-sense.de
+ Date:   Thu May 26 16:25:57 2011 -0700
+ 
+ fs/partitions/efi.c: corrupted GUID partition tables can

[Bug 795418] Re: CVE-2011-1577

2011-06-10 Thread Andy Whitcroft 
** Changed in: linux (Ubuntu Natty)
   Status: New = In Progress

** Changed in: linux (Ubuntu Natty)
 Assignee: (unassigned) = Andy Whitcroft (apw)

** Changed in: linux (Ubuntu Maverick)
   Status: New = In Progress

** Changed in: linux (Ubuntu Maverick)
 Assignee: (unassigned) = Andy Whitcroft (apw)

** Changed in: linux (Ubuntu Lucid)
   Status: New = In Progress

** Changed in: linux (Ubuntu Lucid)
 Assignee: (unassigned) = Andy Whitcroft (apw)

** Changed in: linux (Ubuntu Hardy)
   Status: New = In Progress

** Changed in: linux (Ubuntu Hardy)
 Assignee: (unassigned) = Andy Whitcroft (apw)

** Changed in: linux-lts-backport-maverick (Ubuntu Lucid)
   Status: New = Confirmed

** Changed in: linux-mvl-dove (Ubuntu Lucid)
   Status: New = Confirmed

** Changed in: linux-mvl-dove (Ubuntu Maverick)
   Status: New = Confirmed

** Changed in: linux-fsl-imx51 (Ubuntu Lucid)
   Status: New = Confirmed

** Changed in: linux-ec2 (Ubuntu Lucid)
   Status: New = Confirmed

** Changed in: linux-ti-omap4 (Ubuntu Maverick)
   Status: New = Confirmed

** Changed in: linux-ti-omap4 (Ubuntu Natty)
   Status: New = Confirmed

** Changed in: linux-ti-omap4 (Ubuntu Oneiric)
   Status: New = Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/795418

Title:
  CVE-2011-1577

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/795418/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs