CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2006-5173
https://notcve.org/view.php?id=CVE-2006-5173
Linux kernel does not properly save or restore EFLAGS during a context switch, or reset the flags when creating new threads, which allows local users to cause a denial of service (process crash), as demonstrated using a process that sets the Alignment Check flag (EFLAGS 0x40000), which triggers a SIGBUS in other processes that have an unaligned access. El núcleo de Linux no guarda o restaura adecuadamente EFLAGS durante un cambio de contexto, o reinicia las banderas al crear nuevos hilos, lo cual permite a usuarios locales provocar una denegación de servicio (caída de proceso), como ha sido demostrado usando un proceso que establece la bandera Alignment Check (EFLAGS 0x40000), lo cual dispara un SIGBUS en otros procesos que tienen acceso no alineado. • http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=47a5c6fa0e204a2b63309c648bb2fde36836c826 http://secunia.com/advisories/23361 http://secunia.com/advisories/23384 http://secunia.com/advisories/23474 http://secunia.com/advisories/23593 http://secunia.com/advisories/25691 http://www.mandriva.com/security/advisories?name=MDKSA-2007:002 http://www.novell.com/linux/security/advisories/2006_79_kernel.html http://www.securityfocus.com/archive/1/471457 http://w •
CVSS: 7.5EPSS: 5%CPEs: 7EXPL: 1CVE-2006-4997
https://notcve.org/view.php?id=CVE-2006-4997
The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference). La función clip_mkip en net/atm/clip.c del subsistema ATM en el núcleo Linux permite a atacantes remotos provocar una denegación de servicio (panico) mediante vectores no identificados que provocan que el subsisstema ATM acceda a la memoria de búferes de sockets después de que hayan sido liberados (referencia a puntero liberado). • http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206265 http://secunia.com/advisories/22253 http://secunia.com/advisories/22279 http://secunia.com/advisories/22292 http://secunia.com/advisories/22497 http://secunia.com/advisories/22762 http://secunia.com/advisories/22945 http://secunia.com/advisories/23064 http://secunia.com/advisories/23370 http://secunia.com/advisories/23384 http://secunia.com/advisories/23395 http://secunia.com/advisories/23474 http://secunia.com/ • CWE-416: Use After Free •
CVSS: 7.5EPSS: 7%CPEs: 8EXPL: 0CVE-2006-5158 – NFS lockd deadlock
https://notcve.org/view.php?id=CVE-2006-5158
The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a deadlock. El nlmclnt_mark_reclaim en clntlock.c en NFS lockd en el kernel de Linux en versiones anteriores a 2.6.16 permite a atacantes remotos provocar una denegación de servicio (caída de proceso) y denegación de acceso a exportaciones NFS a través de vectores no especificados que desencadenan un oops en el kernel (referencia nula) y bloqueo mutuo. • http://marc.info/?l=linux-kernel&m=113476665626446&w=2 http://marc.info/?l=linux-kernel&m=113494474208973&w=2 http://rhn.redhat.com/errata/RHSA-2007-0488.html http://secunia.com/advisories/23361 http://secunia.com/advisories/23384 http://secunia.com/advisories/23752 http://secunia.com/advisories/25838 http://secunia.com/advisories/26289 http://support.avaya.com/elmodocs2/security/ASA-2007-287.htm http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2 • CWE-667: Improper Locking •
CVSS: 4.3EPSS: 97%CPEs: 8EXPL: 5CVE-2006-3918 – Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security
https://notcve.org/view.php?id=CVE-2006-3918
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file. http_protocol.c en (1) IBM HTTP Server 6.0 anterioa a 6.0.2.13 y 6.1 anterior 6.1.0.1, y (2) Apache HTTP Server 1.3 anterior a 1.3.35, 2.0 anterior a 2.0.58, y 2.2 anterior a 2.2.2, no desinfecta la cabecera Expect desde una respuesta HTTP cuando se refleja en un mensaje de error, lo cul podría permitir un ataque de tipo secuencia de comandos en sitios cruzados (XSS) utilizando los componentes web del cliente que puede enviar cabeceras de su elección en las respuesta, como se demostró con la utilización de un archivo Flash SWF. Oracle HTTP Server for Oracle Application Server 10g version 10.1.2.0.2 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/28424 ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.html http://archives.neohapsis.com/archives/bugtraq/2006-07/0425.html http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html http://marc.info/?l=bugtraq&m=125631037611762&w=2 http://marc.info/?l=bugtraq&m=12919089961 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •