CVSS: 7.2EPSS: 4%CPEs: 247EXPL: 0CVE-2010-1084 – kernel: bluetooth: potential bad memory access with sysfs files
https://notcve.org/view.php?id=CVE-2010-1084
Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c. El kernel de Linux desde v2.6.18 hasta v2.6.33, y posiblemente otras versiones, permite a atacantes remotos producir una denegación de servicio (corrupcion de memoria) a traves de un gran numero de sockets Bluetooth, relacionados con ficheros sysfs en (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, y (4) net/bluetooth/sco.c. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 http://secunia.com/advisories/39830 http://secunia.com/advisories/43315 http://security-tracker.debian.org/tracker/CVE-2010-1084 http://www.debian.org/security/2010/dsa-2053 http://www.openwall.com/lists/oss-security/2010/03/23/1 http://www.redhat.com/support/errata/RHSA-2010-0610.html http://www.securityfocus.com/archive/1/516397/100/0/threaded http:/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.9EPSS: 0%CPEs: 252EXPL: 0CVE-2010-1088 – kernel: fix LOOKUP_FOLLOW on automount "symlinks"
https://notcve.org/view.php?id=CVE-2010-1088
fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW. fs/namei.c en Linux kernel desde v2.6.18 hasta v2.6.34, no siempre sigue los enlaces simbólicos de automontado NFS, lo que permite a atacantes producir un impacto desconocido, relacionado con LOOKUP_FOLLOW. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=ac278a9c505092dd82077a2446af8f9fc0d9c095 http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html http://secunia.com/advisories/39742 http://secunia.com/advisories/39830 http://secunia.com/advisories/43315 http://www.debian.org/security/2010/dsa-2053 http://www.mandriva.com/security/advisories?name=MDVSA-2010:088 http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 http://www.n •
CVSS: 7.8EPSS: 5%CPEs: 287EXPL: 2CVE-2010-0437 – Linux Kernel 2.6.x - 'net/ipv6/ip6_output.c' Null Pointer Dereference Denial of Service
https://notcve.org/view.php?id=CVE-2010-0437
The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors. La función ip6_dst_lookup_tail en net/ipv6/ip6_output.c en el kernel de linux anterior a v2.6.27 no maneja adecuadamente bajo determinadas circunstancias que involucran a la interfaz de red IPv6 TUN y un gran número de vecinos, lo que permite a atacantes remotos provocar una denegación de servicio (deferencia a puntero nulo y OOPS) o posiblemente tener un impacto desconocido a través de vectores desconocidos. • https://www.exploit-db.com/exploits/33635 http://bugzilla.kernel.org/show_bug.cgi?id=11469 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b http://secunia.com/advisories/39033 http://secunia.com/advisories/43315 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27 http://www.openwall.com/lists/oss-security/2010/02/11/1 http://www.openwall.com/lists/oss-security/2010/03/04/4 http:/&#x • CWE-476: NULL Pointer Dereference •
CVSS: 4.7EPSS: 0%CPEs: 338EXPL: 0CVE-2009-4138 – kernel: firewire: ohci: handle receive packets with a data length of zero
https://notcve.org/view.php?id=CVE-2009-4138
drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains zero in the payload-length field. drivers/firewire/ohci.c en el kernel de Linux anterior a v2.6.32-git9, cuando se usa el modo packet-per-buffer, permite a usuarios locales provocar una denegación de servicio (deferencia a puntero NULL y caída del sistema) o posiblemente otro impacto desconocido a través de un ioctl sin especificar asociado a cuando se recibe un paquete ISO que contiene Zero en el campo payload-length. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://patchwork.kernel.org/patch/66747 http://secunia.com/advisories/38017 http://secunia.com/advisories/38276 http://support.avaya.com/css/P8/documents/ • CWE-399: Resource Management Errors •
CVSS: 7.1EPSS: 2%CPEs: 332EXPL: 1CVE-2009-4307 – kernel: ext4: avoid divide by zero when trying to mount a corrupted file system
https://notcve.org/view.php?id=CVE-2009-4307
The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value). La funcion ext4_fill_flex_info en fs/ext4/super.c en el kernel de Linux anteriores a v2.6.32-git6 permite a atacantes remotos asistidos por el usuario producir una denegación de servicio (error de división por cero y panic) a través de un sistema de ficheros ext4 malformado que contenga un super bloque con un valor de tamaño de grupo FLEX_BG grande (también conocido como valor s_log_groups_per_flex). • http://bugzilla.kernel.org/show_bug.cgi?id=14287 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=503358ae01b70ce6909d19dd01287093f6b6271c http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html http://lkml.org/lkml/2009/12/9/255 http://secunia.com/advisories/37658 http://secunia.com/advisories/38017 http://secunia.com/advisories/38276 http://www.kernel.org&#x • CWE-189: Numeric Errors •