This bug was fixed in the package linux-fsl-imx51 - 2.6.31-610.28
--------------- linux-fsl-imx51 (2.6.31-610.28) lucid-proposed; urgency=low
* Release tracking bug - LP: #837802
[ Upstream Kernel Changes ]
* ipv6: make fragment identifications less predictable, CVE-2011-2699 - LP: #827685 - CVE-2011-2699 * perf: Fix software event overflow, CVE-2011-2918 - LP: #834121 - CVE-2011-2918 * proc: fix oops on invalid /proc/<pid>/maps access, CVE-2011-1020 - LP: #813026 - CVE-2011-1020
linux-fsl-imx51 (2.6.31-610.27) lucid-proposed; urgency=low
* Release tracking bug - LP: #829160
* fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops - LP: #795418 - CVE-2011-1577 * Fix corrupted OSF partition table parsing - LP: #796606 - CVE-2011-1163 * can: Add missing socket check in can/bcm release. - LP: #796502 - CVE-2011-1598 * proc: protect mm start_code/end_code in /proc/pid/stat - LP: #799906 - CVE-2011-0726 * sctp: Fix a race between ICMP protocol unreachable and connect() * tty: Make tiocgicount a handler, CVE-2010-4076, CVE-2010-4077 - LP: #794034 - CVE-2010-4077 * filter: make sure filters dont read uninitialized memory CVE-2010-4158 - LP: #721282 - CVE-2010-4158 * bio: take care not overflow page count when mapping/copying user data CVE-2010-4162 - LP: #721441 - CVE-2010-4162 * block: check for proper length of iov entries in blk_rq_map_user_iov() - LP: #721504 - CVE-2010-4163 * block: check for proper length of iov entries earlier in blk_rq_map_user_iov(), CVE-2010-4163 - LP: #721504 - CVE-2010-4163 * rds: Integer overflow in RDS cmsg handling, CVE-2010-4175 - LP: #721455 - CVE-2010-4175 * bluetooth: Fix missing NULL check CVE-2010-4242 - LP: #714846 - CVE-2010-4242 * IB/uverbs: Handle large number of entries in poll CQ CVE-2010-4649 - LP: #800121 - CVE-2010-4649 * epoll: prevent creating circular epoll structures CVE-2011-1082 - LP: #800758 - CVE-2011-1082 * nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3) CVE-2011-1090 - LP: #800775 * ldm: corrupted partition table can cause kernel oops CVE-2011-1012 - LP: #801083 - CVE-2011-1012 * netfilter: ipt_CLUSTERIP: fix buffer overflow CVE-2011-2534 - LP: #801473 - CVE-2011-2534 * netfilter: arp_tables: fix infoleak to userspace CVE-2011-1170 - LP: #801480 - CVE-2011-1170 * netfilter: ip_tables: fix infoleak to userspace CVE-2011-1171 - LP: #801482 - CVE-2011-1171 * ipv6: netfilter: ip6_tables: fix infoleak to userspace CVE-2011-1172 - LP: #801483 - CVE-2011-1172 * econet: 4 byte infoleak to the network CVE-2011-1173 - LP: #801484 - CVE-2011-1173 * net: Limit socket I/O iovec total length to INT_MAX. - LP: #708839 * fs/partitions: Validate map_count in Mac partition tables - CVE-2011-1010 - LP: #804225 - CVE-2011-1010 * drm: fix unsigned vs signed comparison issue in modeset ctl ioctl, CVE-2011-1013 - LP: #804229 - CVE-2011-1013 * exec: copy-and-paste the fixes into compat_do_execve() paths - CVE-2010-4243 - LP: #804234 - CVE-2010-4243 * taskstats: don't allow duplicate entries in listener mode, CVE-2011-2484 - LP: #806390 - CVE-2011-2484 * dccp: handle invalid feature options length, CVE-2011-1770 - LP: #806375 - CVE-2011-1770 * pagemap: close races with suid execve, CVE-2011-1020 - LP: #813026 - CVE-2011-1020 * report errors in /proc/*/*map* sanely, CVE-2011-1020 - LP: #813026 - CVE-2011-1020 * close race in /proc/*/environ, CVE-2011-1020 - LP: #813026 - CVE-2011-1020 * auxv: require the target to be tracable (or yourself), CVE-2011-1020 - LP: #813026 - CVE-2011-1020 * deal with races in /proc/*/{syscall, stack, personality}, CVE-2011-1020 - LP: #813026 - CVE-2011-1020 * dccp: fix oops on Reset after close, CVE-2011-1093 - LP: #814087 - CVE-2011-1093 * net: add limit for socket backlog CVE-2010-4251 - LP: #807462 * tcp: use limited socket backlog CVE-2010-4251 - LP: #807462 * ipv6: udp: Optimise multicast reception - LP: #807462 * ipv4: udp: Optimise multicast reception - LP: #807462 * udp: multicast RX should increment SNMP/sk_drops counter in allocation failures CVE-2010-4251 - LP: #807462 * udp: use limited socket backlog CVE-2010-4251 - LP: #807462 * llc: use limited socket backlog CVE-2010-4251 - LP: #807462 * sctp: use limited socket backlog CVE-2010-4251 - LP: #807462 * tipc: use limited socket backlog CVE-2010-4251 - LP: #807462 * x25: use limited socket backlog CVE-2010-4251 - LP: #807462 * net: backlog functions rename CVE-2010-4251 - LP: #807462 * net: sk_add_backlog() take rmem_alloc into account CVE-2010-4805 - LP: #809318 * Bluetooth: sco: fix information leak to userspace, CVE-2011-1078 - LP: #816542 - CVE-2011-1078 * Bluetooth: bnep: fix buffer overflow, CVE-2011-1079 - LP: #816544 - CVE-2011-1079 * bridge: netfilter: fix information leak, CVE-2011-1080 - LP: #816545 - CVE-2011-1080 * char/tpm: Fix unitialized usage of data buffer, CVE-2011-1160 - LP: #816546 - CVE-2011-1160 * irda: validate peer name and attribute lengths, CVE-2011-1180 - LP: #816547 - CVE-2011-1180 * gro: Reset dev pointer on reuse, CVE-2011-1478 - LP: #816549 - CVE-2011-1478 * gro: reset skb_iif on reuse, CVE-2011-1478 - LP: #816549 - CVE-2011-1478 * rose_loopback_timer sets VC number <= ROSE_DEFAULT_MAXVC, CVE-2011-1493 - LP: #816550 - CVE-2011-1493 * ROSE: prevent heap corruption with bad facilities, CVE-2011-1493 - LP: #816550 - CVE-2011-1493 * rose: Add length checks to CALL_REQUEST parsing, CVE-2011-1493 - LP: #816550 - CVE-2011-1493 * Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace. - LP: #819569 - CVE-2011-2492 * Add mount option to check uid of device being mounted = expect uid, CVE-2011-1833 - LP: #732628 - CVE-2011-1833 -- Paolo Pisati <email address hidden> Wed, 31 Aug 2011 10:26:26 +0200
This bug was fixed in the package linux-fsl-imx51 - 2.6.31-610.28
---------------
linux-fsl-imx51 (2.6.31-610.28) lucid-proposed; urgency=low
* Release tracking bug
- LP: #837802
[ Upstream Kernel Changes ]
* ipv6: make fragment identifications less predictable, CVE-2011-2699
- LP: #827685
- CVE-2011-2699
* perf: Fix software event overflow, CVE-2011-2918
- LP: #834121
- CVE-2011-2918
* proc: fix oops on invalid /proc/<pid>/maps access, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
linux-fsl-imx51 (2.6.31-610.27) lucid-proposed; urgency=low
* Release tracking bug
- LP: #829160
[ Upstream Kernel Changes ]
* fs/partitions/ efi.c: corrupted GUID partition tables can cause kernel map_user_ iov() rq_map_ user_iov( ), CVE-2010-4163
oops
- LP: #795418
- CVE-2011-1577
* Fix corrupted OSF partition table parsing
- LP: #796606
- CVE-2011-1163
* can: Add missing socket check in can/bcm release.
- LP: #796502
- CVE-2011-1598
* proc: protect mm start_code/end_code in /proc/pid/stat
- LP: #799906
- CVE-2011-0726
* sctp: Fix a race between ICMP protocol unreachable and connect()
* tty: Make tiocgicount a handler, CVE-2010-4076, CVE-2010-4077
- LP: #794034
- CVE-2010-4077
* filter: make sure filters dont read uninitialized memory CVE-2010-4158
- LP: #721282
- CVE-2010-4158
* bio: take care not overflow page count when mapping/copying user data
CVE-2010-4162
- LP: #721441
- CVE-2010-4162
* block: check for proper length of iov entries in blk_rq_
- LP: #721504
- CVE-2010-4163
* block: check for proper length of iov entries earlier in
blk_
- LP: #721504
- CVE-2010-4163
* rds: Integer overflow in RDS cmsg handling, CVE-2010-4175
- LP: #721455
- CVE-2010-4175
* bluetooth: Fix missing NULL check CVE-2010-4242
- LP: #714846
- CVE-2010-4242
* IB/uverbs: Handle large number of entries in poll CQ CVE-2010-4649
- LP: #800121
- CVE-2010-4649
* epoll: prevent creating circular epoll structures CVE-2011-1082
- LP: #800758
- CVE-2011-1082
* nfs4: Ensure that ACL pages sent over NFS were not allocated from the
slab (v3) CVE-2011-1090
- LP: #800775
* ldm: corrupted partition table can cause kernel oops CVE-2011-1012
- LP: #801083
- CVE-2011-1012
* netfilter: ipt_CLUSTERIP: fix buffer overflow CVE-2011-2534
- LP: #801473
- CVE-2011-2534
* netfilter: arp_tables: fix infoleak to userspace CVE-2011-1170
- LP: #801480
- CVE-2011-1170
* netfilter: ip_tables: fix infoleak to userspace CVE-2011-1171
- LP: #801482
- CVE-2011-1171
* ipv6: netfilter: ip6_tables: fix infoleak to userspace CVE-2011-1172
- LP: #801483
- CVE-2011-1172
* econet: 4 byte infoleak to the network CVE-2011-1173
- LP: #801484
- CVE-2011-1173
* net: Limit socket I/O iovec total length to INT_MAX.
- LP: #708839
* fs/partitions: Validate map_count in Mac partition tables -
CVE-2011-1010
- LP: #804225
- CVE-2011-1010
* drm: fix unsigned vs signed comparison issue in modeset ctl ioctl,
CVE-2011-1013
- LP: #804229
- CVE-2011-1013
* exec: copy-and-paste the fixes into compat_do_execve() paths -
CVE-2010-4243
- LP: #804234
- CVE-2010-4243
* taskstats: don't allow duplicate entries in listener mode,
CVE-2011-2484
- LP: #806390
- CVE-2011-2484
* dccp: handle invalid feature options length, CVE-2011-1770
- LP: #806375
- CVE-2011-1770
* pagemap: close races with suid execve, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
* report errors in /proc/*/*map* sanely, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
* close race in /proc/*/environ, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
* auxv: require the target to be tracable (or yourself), CVE-2011-1020
- LP: #813026
- CVE-2011-1020
* deal with races in /proc/*/{syscall, stack, personality}, CVE-2011-1020
- LP: #813026
- CVE-2011-1020
* dccp: fix oops on Reset after close, CVE-2011-1093
- LP: #814087
- CVE-2011-1093
* net: add limit for socket backlog CVE-2010-4251
- LP: #807462
* tcp: use limited socket backlog CVE-2010-4251
- LP: #807462
* ipv6: udp: Optimise multicast reception
- LP: #807462
* ipv4: udp: Optimise multicast reception
- LP: #807462
* udp: multicast RX should increment SNMP/sk_drops counter in allocation
failures CVE-2010-4251
- LP: #807462
* udp: use limited socket backlog CVE-2010-4251
- LP: #807462
* llc: use limited socket backlog CVE-2010-4251
- LP: #807462
* sctp: use limited socket backlog CVE-2010-4251
- LP: #807462
* tipc: use limited socket backlog CVE-2010-4251
- LP: #807462
* x25: use limited socket backlog CVE-2010-4251
- LP: #807462
* net: backlog functions rename CVE-2010-4251
- LP: #807462
* net: sk_add_backlog() take rmem_alloc into account CVE-2010-4805
- LP: #809318
* Bluetooth: sco: fix information leak to userspace, CVE-2011-1078
- LP: #816542
- CVE-2011-1078
* Bluetooth: bnep: fix buffer overflow, CVE-2011-1079
- LP: #816544
- CVE-2011-1079
* bridge: netfilter: fix information leak, CVE-2011-1080
- LP: #816545
- CVE-2011-1080
* char/tpm: Fix unitialized usage of data buffer, CVE-2011-1160
- LP: #816546
- CVE-2011-1160
* irda: validate peer name and attribute lengths, CVE-2011-1180
- LP: #816547
- CVE-2011-1180
* gro: Reset dev pointer on reuse, CVE-2011-1478
- LP: #816549
- CVE-2011-1478
* gro: reset skb_iif on reuse, CVE-2011-1478
- LP: #816549
- CVE-2011-1478
* rose_loopback_timer sets VC number <= ROSE_DEFAULT_MAXVC, CVE-2011-1493
- LP: #816550
- CVE-2011-1493
* ROSE: prevent heap corruption with bad facilities, CVE-2011-1493
- LP: #816550
- CVE-2011-1493
* rose: Add length checks to CALL_REQUEST parsing, CVE-2011-1493
- LP: #816550
- CVE-2011-1493
* Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace.
- LP: #819569
- CVE-2011-2492
* Add mount option to check uid of device being mounted = expect uid,
CVE-2011-1833
- LP: #732628
- CVE-2011-1833
-- Paolo Pisati <email address hidden> Wed, 31 Aug 2011 10:26:26 +0200