CVE-2011-2203

CVE-2011-2203

This bug was fixed in the package linux-ti-omap4 - 2.6.38-1209.19

---------------
linux-ti-omap4 (2.6.38-1209.19) natty-proposed; urgency=low

  * Release Tracking Bug
    - LP: #906913

  [ Upstream Kernel Changes ]

  * use cache type functions for arch_get_unmapped_area
  * topdown mmap support
  * TPM: Zero buffer after copying to userspace, CVE-2011-1162
    - LP: #899463
    - CVE-2011-1162
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
 -- Andy Whitcroft <email address hidden> Tue, 20 Dec 2011 14:27:12 +0000

This bug was fixed in the package linux-fsl-imx51 - 2.6.31-612.32

---------------
linux-fsl-imx51 (2.6.31-612.32) lucid-proposed; urgency=low

  * Release Tracking Bug
    - LP: #906939

  [ Upstream Kernel Changes ]

  * Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
  * resource: add helpers for fetching rlimits
  * use cache type functions for arch_get_unmapped_area
  * topdown mmap support
  * TPM: Zero buffer after copying to userspace, CVE-2011-1162
    - LP: #899463
    - CVE-2011-1162
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369, #unable to handle kernel NULL pointer dereference at 0000000000000008
    - CVE-2011-4110
  * gro: reset vlan_tci on reuse
    - LP: #844361, #902317
    - CVE-2011-1576
 -- Andy Whitcroft <email address hidden> Tue, 20 Dec 2011 15:31:26 +0000

This bug was fixed in the package linux-ti-omap4 - 2.6.35-903.29

---------------
linux-ti-omap4 (2.6.35-903.29) maverick-proposed; urgency=low

  * Release Tracking Bug
    - LP: #911245

  [ Upstream Kernel Changes ]

  * Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
  * use cache type functions for arch_get_unmapped_area
  * topdown mmap support
  * TPM: Zero buffer after copying to userspace, CVE-2011-1162
    - LP: #899463
    - CVE-2011-1162
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * gro: reset vlan_tci on reuse
    - LP: #844361
    - CVE-2011-1576
  * b43: allocate receive buffers big enough for max frame len + offset
    - LP: #905060
    - CVE-2011-3359
  * fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message, CVE-2011-3353
    - LP: #905058
    - CVE-2011-3353
 -- Paolo Pisati <email address hidden> Wed, 04 Jan 2012 13:09:43 +0100

This bug was fixed in the package linux-ec2 - 2.6.32-342.43

---------------
linux-ec2 (2.6.32-342.43) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-38.83
  * XEN: x86/mpparse: Account for bus types other than ISA and PCI
    - LP: #902317
  * Release Tracking Bug
    - LP: #911230

  [ Ubuntu: 2.6.32-38.83 ]

  * Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    - LP: #911392
  * Linux 2.6.32.52
    - LP: #911392

  [ Ubuntu: 2.6.32-38.82 ]

  * SAUCE: netns: Add quota for number of NET_NS instances.
  * [Config] CONFIG_NET_NS=y
    - LP: #790863
  * Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * net: ipv4: relax AF_INET check in bind()
    - LP: #900396
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * i2c-algo-bit: Generate correct i2c address sequence for 10-bit target
    - LP: #902317
  * eCryptfs: Extend array bounds for all filename chars
    - LP: #902317
  * PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs
    - LP: #902317
  * ARM: 7161/1: errata: no automatic store buffer drain
    - LP: #902317
  * ALSA: lx6464es - fix device communication via command bus
    - LP: #902317
  * SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared
    - LP: #902317
  * timekeeping: add arch_offset hook to ktime_get functions
    - LP: #902317
  * p54spi: Add missing spin_lock_init
    - LP: #902317
  * p54spi: Fix workqueue deadlock
    - LP: #902317
  * nl80211: fix MAC address validation
    - LP: #902317
  * gro: reset vlan_tci on reuse
    - LP: #902317
  * staging: usbip: bugfix for deadlock
    - LP: #902317
  * staging: comedi: fix oops for USB DAQ devices.
    - LP: #902317
  * Staging: comedi: fix signal handling in read and write
    - LP: #902317
  * USB: whci-hcd: fix endian conversion in qset_clear()
    - LP: #902317
  * usb: ftdi_sio: add PID for Propox ISPcable III
    - LP: #902317
  * usb: option: add SIMCom SIM5218
    - LP: #902317
  * USB: usb-storage: unusual_devs entry for Kingston DT 101 G2
    - LP: #902317
  * SCSI: scsi_lib: fix potential NULL dereference
    - LP: #902317
  * SCSI: Silencing 'killing requests for dead queue'
    - LP: #902317
  * cifs: fix cifs stable patch cifs-fix-oplock-break-handling-try-2.patch
    - LP: #902317
  * sched, x86: Avoid unnecessary overflow in sched_clock
    - LP: #902317
  * x86/mpparse: Account for bus types other than ISA and PCI
    - LP: #902317
  * oprofile, x86: Fix crash when unloading module (nmi timer mode)
    - LP: #902317
  * genirq: Fix race condition when stopping the irq thread
    - LP: #902317
  * tick-broadcast: Stop active broadcast device when replacing it
    - LP: #902317
  * clockevents: Set noop handler in clockevents_exchange_device()
    - LP: #902317
  * Linux 2.6.32.50
    - LP: #902317
  * nfsd4: permit read opens of executable-only files
    - LP: #833300
  * ipv6: Allow inet6_dump_addr() to handle more than 64 addresses
    - LP: #863394
  * ALSA...

This bug was fixed in the package linux - 2.6.24-30.98

---------------
linux (2.6.24-30.98) hardy-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #910893

  [Upstream Kernel Changes]

  * TPM: Zero buffer after copying to userspace, CVE-2011-1162
    - LP: #899463
    - CVE-2011-1162
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369, #unable to handle kernel NULL pointer dereference at 0000000000000008
    - CVE-2011-4110
  * ieee80211: Add IEEE80211_MAX_FRAME_LEN to linux/ieee80211.h
    - LP: #905060
    - CVE-2011-3359
  * b43: allocate receive buffers big enough for max frame len + offset
    - LP: #905060
    - CVE-2011-3359
 -- Herton Ronaldo Krzesinski <email address hidden> Mon, 02 Jan 2012 14:12:10 -0200

This bug was fixed in the package linux-lts-backport-maverick - 2.6.35-32.64~lucid1

---------------
linux-lts-backport-maverick (2.6.35-32.64~lucid1) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #911248

  [ Seth Forshee ]

  * SAUCE: dell-wmi: Demote unknown WMI event message to pr_debug
    - LP: #581312

  [ Upstream Kernel Changes ]

  * Revert "Revert "xen: set max_pfn_mapped to the last pfn mapped""
    - LP: #898139
  * Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
    - LP: #844361
  * kbuild: Disable -Wunused-but-set-variable for gcc 4.6.0
    - LP: #898139
  * kbuild: Fix passing -Wno-* options to gcc 4.4+
    - LP: #898139
  * maintainer
    - LP: #898139
  * Remove the old V4L1 v4lgrab.c file
    - LP: #898139
  * i8k: Tell gcc that *regs gets clobbered
    - LP: #898139
  * Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again)
    - LP: #898139
  * USB: serial/usb_wwan, fix tty NULL dereference
    - LP: #898139
  * ipv6: add special mode accept_ra=2 to accept RA while configured as
    router
    - LP: #898139
  * set memory ranges in N_NORMAL_MEMORY when onlined
    - LP: #898139
  * FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci
    - LP: #898139
  * m68k/mm: Set all online nodes in N_NORMAL_MEMORY
    - LP: #898139
  * nfs: don't lose MS_SYNCHRONOUS on remount of noac mount
    - LP: #898139
  * NFSv4.1: Ensure state manager thread dies on last umount
    - LP: #898139
  * Input: xen-kbdfront - fix mouse getting stuck after save/restore
    - LP: #898139
  * pmcraid: reject negative request size
    - LP: #898139
  * mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot()
    - LP: #898139
  * mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish
    - LP: #898139
  * mmc: sdhci: Check mrq != NULL in sdhci_tasklet_finish
    - LP: #898139
  * USB: fix regression in usbip by setting has_tt flag
    - LP: #898139
  * ARM: 6891/1: prevent heap corruption in OABI semtimedop
    - LP: #898139
  * Open with O_CREAT flag set fails to open existing files on non writable
    directories
    - LP: #898139
  * Input: elantech - discard the first 2 positions on some firmwares
    - LP: #898139
  * Staging: rtl8192su: Clean up in case of an error in module
    initialisation
    - LP: #898139
  * Staging: rtl8192su: Fix procfs code for interfaces not named wlan0
    - LP: #898139
  * USB: teach "devices" file about Wireless and SuperSpeed USB
    - LP: #898139
  * SUNRPC: fix NFS client over TCP hangs due to packet loss (Bug 16494)
    - LP: #898139
  * nfs: fix compilation warning
    - LP: #898139
  * Increase OSF partition limit from 8 to 18
    - LP: #898139
  * hwmon: (applesmc) Add MacBookAir3,1(3,2) support
    - LP: #898139
  * ALSA: emux: Add trivial compat ioctl handler
    - LP: #898139
  * ALSA: hda - MacBookPro 5,3 line-in support
    - LP: #898139
  * ALSA: hda - Add model=mbp55 entry for MacBookPro 7,1
    - LP: #898139
  * ALSA: hda - MacBookAir3,1(3,2) alsa support
    - LP: #898139
  * Bluetooth: Add support Bluetooth controller of MacbookPro 6,2
    - LP: #898139
  * Bluetooth: Add support Bluetooth controller of MacbookPro 7,1
    -...

This bug was fixed in the package linux-mvl-dove - 2.6.32-422.40

---------------
linux-mvl-dove (2.6.32-422.40) maverick-proposed; urgency=low

  * Release Tracking Bug
    - LP: #911246

  [ Paolo Pisati ]

  * Rebased to 2.6.32-38.83

  [ Ubuntu: 2.6.32-38.83 ]

  * Release Tracking Bug
    - LP: #911405
  * Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    - LP: #911392
  * Linux 2.6.32.52
    - LP: #911392

  [ Ubuntu: 2.6.32-38.82 ]

  * Release Tracking Bug
    - LP: #910906
  * SAUCE: netns: Add quota for number of NET_NS instances.
  * [Config] CONFIG_NET_NS=y
    - LP: #790863
  * Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * net: ipv4: relax AF_INET check in bind()
    - LP: #900396
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * i2c-algo-bit: Generate correct i2c address sequence for 10-bit target
    - LP: #902317
  * eCryptfs: Extend array bounds for all filename chars
    - LP: #902317
  * PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs
    - LP: #902317
  * ARM: 7161/1: errata: no automatic store buffer drain
    - LP: #902317
  * ALSA: lx6464es - fix device communication via command bus
    - LP: #902317
  * SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared
    - LP: #902317
  * timekeeping: add arch_offset hook to ktime_get functions
    - LP: #902317
  * p54spi: Add missing spin_lock_init
    - LP: #902317
  * p54spi: Fix workqueue deadlock
    - LP: #902317
  * nl80211: fix MAC address validation
    - LP: #902317
  * gro: reset vlan_tci on reuse
    - LP: #902317
  * staging: usbip: bugfix for deadlock
    - LP: #902317
  * staging: comedi: fix oops for USB DAQ devices.
    - LP: #902317
  * Staging: comedi: fix signal handling in read and write
    - LP: #902317
  * USB: whci-hcd: fix endian conversion in qset_clear()
    - LP: #902317
  * usb: ftdi_sio: add PID for Propox ISPcable III
    - LP: #902317
  * usb: option: add SIMCom SIM5218
    - LP: #902317
  * USB: usb-storage: unusual_devs entry for Kingston DT 101 G2
    - LP: #902317
  * SCSI: scsi_lib: fix potential NULL dereference
    - LP: #902317
  * SCSI: Silencing 'killing requests for dead queue'
    - LP: #902317
  * cifs: fix cifs stable patch cifs-fix-oplock-break-handling-try-2.patch
    - LP: #902317
  * sched, x86: Avoid unnecessary overflow in sched_clock
    - LP: #902317
  * x86/mpparse: Account for bus types other than ISA and PCI
    - LP: #902317
  * oprofile, x86: Fix crash when unloading module (nmi timer mode)
    - LP: #902317
  * genirq: Fix race condition when stopping the irq thread
    - LP: #902317
  * tick-broadcast: Stop active broadcast device when replacing it
    - LP: #902317
  * clockevents: Set noop handler in clockevents_exchange_device()
    - LP: #902317
  * Linux 2.6.32.50
    - LP: #902317
  * nfsd4: permit read opens of executable-only files
    - LP: #833300
  * ipv6: Allow inet6_dump_addr() to handle more than 64 addresses
    - LP: #863394
...

This bug was fixed in the package linux-ti-omap4 - 3.0.0-1206.15

---------------
linux-ti-omap4 (3.0.0-1206.15) oneiric-proposed; urgency=low

  * Release Tracking Bug
    - LP: #911102

  [ Ubuntu: 3.0.0-15.25 ]

  * Release Tracking Bug
    - LP: #910894
  * Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    - LP: #904569

linux-ti-omap4 (3.0.0-1206.14) oneiric-proposed; urgency=low

  * Release Tracking Bug
    - LP: #903695

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.0.0-15.24
  * [Config] updateconfigs (PL310_ERRATA_769419=N)

  [ Upstream Kernel Changes ]

  * use cache type functions for arch_get_unmapped_area
  * topdown mmap support

  [ Ubuntu: 3.0.0-15.24 ]

  * Release Tracking Bug
    - LP: #903188
  * (config) Change Xen paravirt drivers to be built-in
    - LP: #886521
  * Revert "SAUCE: HID: hid-ntrig: add support for 1b96:0006 model"
    - LP: #724831
  * Revert "SAUCE: hid: ntrig: Remove unused device ids"
    - LP: #724831
  * SAUCE: dell-wmi: Demote unknown WMI event message to pr_debug
    - LP: #581312
  * Revert "leds: save the delay values after a successful call to
    blink_set()"
    - LP: #893741
  * xfs: Fix possible memory corruption in xfs_readlink, CVE-2011-4077
    - LP: #887298
    - CVE-2011-4077
  * drm/i915: fix IVB cursor support
    - LP: #893222
  * drm/i915: always set FDI composite sync bit
    - LP: #893222
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #893148
    - CVE-2011-4132
  * ALSA: hda - Don't add elements of other codecs to vmaster slave
    - LP: #893741
  * virtio-pci: fix use after free
    - LP: #893741
  * ASoC: Don't use wm8994->control_data in wm8994_readable_register()
    - LP: #893741
  * sh: Fix cached/uncaced address calculation in 29bit mode
    - LP: #893741
  * drm/i915: Fix object refcount leak on mmappable size limit error path.
    - LP: #893741
  * drm/nouveau: initialize chan->fence.lock before use
    - LP: #893741
  * drm/radeon/kms: make an aux failure debug only
    - LP: #893741
  * ALSA: usb-audio - Check the dB-range validity in the later read, too
    - LP: #893741
  * ALSA: usb-audio - Fix the missing volume quirks at delayed init
    - LP: #893741
  * KEYS: Fix a NULL pointer deref in the user-defined key type
    - LP: #893741
  * hfs: add sanity check for file name length
    - LP: #893741
  * drm/radeon: add some missing FireMV pci ids
    - LP: #893741
  * sfi: table irq 0xFF means 'no interrupt'
    - LP: #893741
  * x86, mrst: use a temporary variable for SFI irq
    - LP: #893741
  * b43: refuse to load unsupported firmware
    - LP: #893741
  * md/raid5: abort any pending parity operations when array fails.
    - LP: #893741
  * mfd: Fix twl4030 dependencies for audio codec
    - LP: #893741
  * xen:pvhvm: enable PVHVM VCPU placement when using more than 32 CPUs.
    - LP: #893741
  * xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
    - LP: #893741
  * xen-gntalloc: signedness bug in add_grefs()
    - LP: #893741
  * powerpc/ps3: Fix lost SMP IPIs
    - LP: #893741
  * powerpc: Copy down exception vectors after feature fixups
    - LP: #893741
  * backing-dev: ensure wakeup_timer is deleted
...

This bug was fixed in the package linux - 2.6.35-32.64

---------------
linux (2.6.35-32.64) maverick-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #910919

  [ Seth Forshee ]

  * SAUCE: dell-wmi: Demote unknown WMI event message to pr_debug
    - LP: #581312

  [ Upstream Kernel Changes ]

  * Revert "Revert "xen: set max_pfn_mapped to the last pfn mapped""
    - LP: #898139
  * Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
    - LP: #844361
  * kbuild: Disable -Wunused-but-set-variable for gcc 4.6.0
    - LP: #898139
  * kbuild: Fix passing -Wno-* options to gcc 4.4+
    - LP: #898139
  * maintainer
    - LP: #898139
  * Remove the old V4L1 v4lgrab.c file
    - LP: #898139
  * i8k: Tell gcc that *regs gets clobbered
    - LP: #898139
  * Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again)
    - LP: #898139
  * USB: serial/usb_wwan, fix tty NULL dereference
    - LP: #898139
  * ipv6: add special mode accept_ra=2 to accept RA while configured as
    router
    - LP: #898139
  * set memory ranges in N_NORMAL_MEMORY when onlined
    - LP: #898139
  * FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci
    - LP: #898139
  * m68k/mm: Set all online nodes in N_NORMAL_MEMORY
    - LP: #898139
  * nfs: don't lose MS_SYNCHRONOUS on remount of noac mount
    - LP: #898139
  * NFSv4.1: Ensure state manager thread dies on last umount
    - LP: #898139
  * Input: xen-kbdfront - fix mouse getting stuck after save/restore
    - LP: #898139
  * pmcraid: reject negative request size
    - LP: #898139
  * mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot()
    - LP: #898139
  * mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish
    - LP: #898139
  * mmc: sdhci: Check mrq != NULL in sdhci_tasklet_finish
    - LP: #898139
  * USB: fix regression in usbip by setting has_tt flag
    - LP: #898139
  * ARM: 6891/1: prevent heap corruption in OABI semtimedop
    - LP: #898139
  * Open with O_CREAT flag set fails to open existing files on non writable
    directories
    - LP: #898139
  * Input: elantech - discard the first 2 positions on some firmwares
    - LP: #898139
  * Staging: rtl8192su: Clean up in case of an error in module
    initialisation
    - LP: #898139
  * Staging: rtl8192su: Fix procfs code for interfaces not named wlan0
    - LP: #898139
  * USB: teach "devices" file about Wireless and SuperSpeed USB
    - LP: #898139
  * SUNRPC: fix NFS client over TCP hangs due to packet loss (Bug 16494)
    - LP: #898139
  * nfs: fix compilation warning
    - LP: #898139
  * Increase OSF partition limit from 8 to 18
    - LP: #898139
  * hwmon: (applesmc) Add MacBookAir3,1(3,2) support
    - LP: #898139
  * ALSA: emux: Add trivial compat ioctl handler
    - LP: #898139
  * ALSA: hda - MacBookPro 5,3 line-in support
    - LP: #898139
  * ALSA: hda - Add model=mbp55 entry for MacBookPro 7,1
    - LP: #898139
  * ALSA: hda - MacBookAir3,1(3,2) alsa support
    - LP: #898139
  * Bluetooth: Add support Bluetooth controller of MacbookPro 6,2
    - LP: #898139
  * Bluetooth: Add support Bluetooth controller of MacbookPro 7,1
    - LP: #898139
  * Bluetooth: Add MacBookAir3,1(2) suppor...

This bug was fixed in the package linux-lts-backport-oneiric - 3.0.0-15.25~lucid1

---------------
linux-lts-backport-oneiric (3.0.0-15.25~lucid1) lucid-proposed; urgency=low

  [Brad Figg]

  * Release Tracking Bug
    - LP: #911103

  [ Upstream Kernel Changes ]

  * Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    - LP: #904569

linux (3.0.0-15.24) oneiric-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #903188

  [ Alex Bligh ]

  * (config) Change Xen paravirt drivers to be built-in
    - LP: #886521

  [ Chase Douglas ]

  * Revert "SAUCE: HID: hid-ntrig: add support for 1b96:0006 model"
    - LP: #724831
  * Revert "SAUCE: hid: ntrig: Remove unused device ids"
    - LP: #724831

  [ Seth Forshee ]

  * SAUCE: dell-wmi: Demote unknown WMI event message to pr_debug
    - LP: #581312

  [ Upstream Kernel Changes ]

  * Revert "leds: save the delay values after a successful call to
    blink_set()"
    - LP: #893741
  * xfs: Fix possible memory corruption in xfs_readlink, CVE-2011-4077
    - LP: #887298
    - CVE-2011-4077
  * drm/i915: fix IVB cursor support
    - LP: #893222
  * drm/i915: always set FDI composite sync bit
    - LP: #893222
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #893148
    - CVE-2011-4132
  * ALSA: hda - Don't add elements of other codecs to vmaster slave
    - LP: #893741
  * virtio-pci: fix use after free
    - LP: #893741
  * ASoC: Don't use wm8994->control_data in wm8994_readable_register()
    - LP: #893741
  * sh: Fix cached/uncaced address calculation in 29bit mode
    - LP: #893741
  * drm/i915: Fix object refcount leak on mmappable size limit error path.
    - LP: #893741
  * drm/nouveau: initialize chan->fence.lock before use
    - LP: #893741
  * drm/radeon/kms: make an aux failure debug only
    - LP: #893741
  * ALSA: usb-audio - Check the dB-range validity in the later read, too
    - LP: #893741
  * ALSA: usb-audio - Fix the missing volume quirks at delayed init
    - LP: #893741
  * KEYS: Fix a NULL pointer deref in the user-defined key type
    - LP: #893741
  * hfs: add sanity check for file name length
    - LP: #893741
  * drm/radeon: add some missing FireMV pci ids
    - LP: #893741
  * sfi: table irq 0xFF means 'no interrupt'
    - LP: #893741
  * x86, mrst: use a temporary variable for SFI irq
    - LP: #893741
  * b43: refuse to load unsupported firmware
    - LP: #893741
  * md/raid5: abort any pending parity operations when array fails.
    - LP: #893741
  * mfd: Fix twl4030 dependencies for audio codec
    - LP: #893741
  * xen:pvhvm: enable PVHVM VCPU placement when using more than 32 CPUs.
    - LP: #893741
  * xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
    - LP: #893741
  * xen-gntalloc: signedness bug in add_grefs()
    - LP: #893741
  * powerpc/ps3: Fix lost SMP IPIs
    - LP: #893741
  * powerpc: Copy down exception vectors after feature fixups
    - LP: #893741
  * backing-dev: ensure wakeup_timer is deleted
    - LP: #893741
  * block: Always check length of all iov entries in blk_rq_map_user_iov()
    - LP: #893741
  * Linux 3.0.10
    - LP: #893741
  * drm/i915: add multi-thr...

This bug was fixed in the package linux-lts-backport-natty - 2.6.38-13.54~lucid1

---------------
linux-lts-backport-natty (2.6.38-13.54~lucid1) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #911710

  [ Alex Bligh ]

  * (config) Change Xen paravirt drivers to be built-in
    - LP: #886521

  [ Paolo Pisati ]

  * [Config] DEFAULT_MMAP_MIN_ADDR=32k on arm
    - LP: #903346

  [ Seth Forshee ]

  * SAUCE: dell-wmi: Demote unknown WMI event message to pr_debug
    - LP: #581312

  [ Upstream Kernel Changes ]

  * VFS: Fix vfsmount overput on simultaneous automount
    - LP: #769927
  * TPM: Zero buffer after copying to userspace, CVE-2011-1162
    - LP: #899463
    - CVE-2011-1162
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * nfsd4: permit read opens of executable-only files
    - LP: #833300
  * Support for Terratec G1
    - LP: #821061

linux (2.6.38-13.53) natty-proposed; urgency=low

  [Brad Figg]

  * Release Tracking Bug
    - LP: #897320

  [ Upstream Kernel Changes ]

  * cifs, freezer: add wait_event_freezekillable and have cifs use it
    - LP: #24330
  * Fixup trivial checkpatch warning
    - LP: #24330
  * Fix build break when freezer not configured
    - LP: #24330
  * PM / Freezer: Reimplement wait_event_freezekillable using
    freezer_do_not_count/freezer_count
    - LP: #24330
  * crypto: ghash - Avoid null pointer dereference if no key is set
    - LP: #887299
    - CVE-2011-4081
  * ata_piix: make DVD Drive recognisable on systems with Intel Sandybridge
    chipsets(v2)
    - LP: #737388, #782389, #794642
  * drm/i915: fix CB tuning check for ILK+
    - LP: #891031
  * xfs: Fix possible memory corruption in xfs_readlink, CVE-2011-4077
    - LP: #887298
    - CVE-2011-4077
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #893148
    - CVE-2011-4132
  * hfs: add sanity check for file name length, CVE-2011-4330
    - LP: #894374
    - CVE-2011-4330
 -- Herton Ronaldo Krzesinski <email address hidden> Wed, 04 Jan 2012 09:47:24 -0200

This bug was fixed in the package linux - 2.6.32-38.83

---------------
linux (2.6.32-38.83) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #911405

  [ Upstream Kernel Changes ]

  * Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    - LP: #911392
  * Linux 2.6.32.52
    - LP: #911392

linux (2.6.32-38.82) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #910906

  [ Tetsuo Handa ]

  * SAUCE: netns: Add quota for number of NET_NS instances.

  [ Tim Gardner ]

  * [Config] CONFIG_NET_NS=y
    - LP: #790863

  [ Upstream Kernel Changes ]

  * Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * net: ipv4: relax AF_INET check in bind()
    - LP: #900396
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * i2c-algo-bit: Generate correct i2c address sequence for 10-bit target
    - LP: #902317
  * eCryptfs: Extend array bounds for all filename chars
    - LP: #902317
  * PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs
    - LP: #902317
  * ARM: 7161/1: errata: no automatic store buffer drain
    - LP: #902317
  * ALSA: lx6464es - fix device communication via command bus
    - LP: #902317
  * SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared
    - LP: #902317
  * timekeeping: add arch_offset hook to ktime_get functions
    - LP: #902317
  * p54spi: Add missing spin_lock_init
    - LP: #902317
  * p54spi: Fix workqueue deadlock
    - LP: #902317
  * nl80211: fix MAC address validation
    - LP: #902317
  * gro: reset vlan_tci on reuse
    - LP: #902317
  * staging: usbip: bugfix for deadlock
    - LP: #902317
  * staging: comedi: fix oops for USB DAQ devices.
    - LP: #902317
  * Staging: comedi: fix signal handling in read and write
    - LP: #902317
  * USB: whci-hcd: fix endian conversion in qset_clear()
    - LP: #902317
  * usb: ftdi_sio: add PID for Propox ISPcable III
    - LP: #902317
  * usb: option: add SIMCom SIM5218
    - LP: #902317
  * USB: usb-storage: unusual_devs entry for Kingston DT 101 G2
    - LP: #902317
  * SCSI: scsi_lib: fix potential NULL dereference
    - LP: #902317
  * SCSI: Silencing 'killing requests for dead queue'
    - LP: #902317
  * cifs: fix cifs stable patch cifs-fix-oplock-break-handling-try-2.patch
    - LP: #902317
  * sched, x86: Avoid unnecessary overflow in sched_clock
    - LP: #902317
  * x86/mpparse: Account for bus types other than ISA and PCI
    - LP: #902317
  * oprofile, x86: Fix crash when unloading module (nmi timer mode)
    - LP: #902317
  * genirq: Fix race condition when stopping the irq thread
    - LP: #902317
  * tick-broadcast: Stop active broadcast device when replacing it
    - LP: #902317
  * clockevents: Set noop handler in clockevents_exchange_device()
    - LP: #902317
  * Linux 2.6.32.50
    - LP: #902317
  * nfsd4: permit read opens of executable-only files
    - LP: #833300
  * ipv6: Allow inet6_dump_addr() to handle more t...

This bug was fixed in the package linux - 2.6.38-13.54

---------------
linux (2.6.38-13.54) natty-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #911195

  [ Alex Bligh ]

  * (config) Change Xen paravirt drivers to be built-in
    - LP: #886521

  [ Paolo Pisati ]

  * [Config] DEFAULT_MMAP_MIN_ADDR=32k on arm
    - LP: #903346

  [ Seth Forshee ]

  * SAUCE: dell-wmi: Demote unknown WMI event message to pr_debug
    - LP: #581312

  [ Upstream Kernel Changes ]

  * VFS: Fix vfsmount overput on simultaneous automount
    - LP: #769927
  * TPM: Zero buffer after copying to userspace, CVE-2011-1162
    - LP: #899463
    - CVE-2011-1162
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * nfsd4: permit read opens of executable-only files
    - LP: #833300
  * Support for Terratec G1
    - LP: #821061
 -- Herton Ronaldo Krzesinski <email address hidden> Tue, 03 Jan 2012 10:03:15 -0200

revert scripting error

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.