CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 1CVE-2010-1148
https://notcve.org/view.php?id=CVE-2010-1148
The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions. La función cifs_create en fs/cifs/dir.c en el kernel de Linux v2.6.33.2 y anteriores permite a usuarios locales causar una denegación de servicio (referencias de puntero nulo y OOPS) o posiblemente tener un impacto no especificado a través de un campo nameidata NULL (tambien llamado nd) en una solicitud de creación de archivos POSIX a un servidor que soporta extensiones UNIX. • http://lists.samba.org/archive/linux-cifs-client/2010-April/005741.html http://lists.samba.org/archive/linux-cifs-client/2010-April/005742.html http://lists.samba.org/archive/linux-cifs-client/2010-April/005746.html http://lists.samba.org/archive/linux-cifs-client/2010-April/005757.html http://marc.info/?l=oss-security&m=127045754521927&w=2 http://marc.info/?l=oss-security&m=127045779122119&w=2 http://openwall.com/lists/oss-security/2010/04/06/2 http://secunia.com • CWE-476: NULL Pointer Dereference •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 4CVE-2010-1146 – ReiserFS (Linux Kernel 2.6.34-rc3 / RedHat / Ubuntu 9.10) - 'xattr' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2010-1146
The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the .reiserfs_priv directory, which allows local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file under .reiserfs_priv/xattrs/. El kernel de Linux v2.6.33.2 y anteriores, cuando esta sobre un sistema de fichero ReiserFS, no restringe adecuadamente la lectura o escritura al directorio .reiserfs_priv, lo que permite a usuarios locales conseguir privilegios mediante la modificación de (1) atributos extendidos o (2) ACLs, como se demuestra mediante el borrado de un fichero bajo .reiserfs_priv/xattrs/. • https://www.exploit-db.com/exploits/12130 http://marc.info/?l=linux-kernel&m=127076012022155&w=2 http://osvdb.org/63601 http://secunia.com/advisories/39316 http://www.exploit-db.com/exploits/12130 http://www.securityfocus.com/bid/39344 https://bugzilla.redhat.com/show_bug.cgi?id=568041 https://exchange.xforce.ibmcloud.com/vulnerabilities/57782 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.7EPSS: 0%CPEs: 339EXPL: 0CVE-2010-1083 – kernel: information leak via userspace USB interface
https://notcve.org/view.php?id=CVE-2010-1083
The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory). La función processcompl_compat en drivers/usb/core/devio.c del kernel de linux v2.6.x a la v2.6.32, y posiblemente otras versiones, no limpia el búfer de transferencia antes de regresar al espacio de usuario cuando falla un comando USB, lo que podría facilitar a atacantes físicamente cercanos obtener información sensible (memoria del kernel). • http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html http://lkml.org/lkml/2010/3/30/759 http://lwn.net/Articles/375350 http://secunia.com/advisories/39742 http://secunia.com/advisories/39830 http://secunia.com/advisories/46397 http://support.avaya.com/css/P8/documents/100090459 http://support.avaya.com/css/P8/documents/100113326 http://www.debian.org/security/2010/dsa-2053 http://www.novell.com/linux/security/advisories/2010_23_kernel.html http • CWE-399: Resource Management Errors •
CVSS: 7.2EPSS: 4%CPEs: 247EXPL: 0CVE-2010-1084 – kernel: bluetooth: potential bad memory access with sysfs files
https://notcve.org/view.php?id=CVE-2010-1084
Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c. El kernel de Linux desde v2.6.18 hasta v2.6.33, y posiblemente otras versiones, permite a atacantes remotos producir una denegación de servicio (corrupcion de memoria) a traves de un gran numero de sockets Bluetooth, relacionados con ficheros sysfs en (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, y (4) net/bluetooth/sco.c. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 http://secunia.com/advisories/39830 http://secunia.com/advisories/43315 http://security-tracker.debian.org/tracker/CVE-2010-1084 http://www.debian.org/security/2010/dsa-2053 http://www.openwall.com/lists/oss-security/2010/03/23/1 http://www.redhat.com/support/errata/RHSA-2010-0610.html http://www.securityfocus.com/archive/1/516397/100/0/threaded http:/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2010-1086 – kernel: dvb-core: DoS bug in ULE decapsulation code
https://notcve.org/view.php?id=CVE-2010-1086
The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame, related to an invalid Payload Pointer ULE. La funcionalidad de descapsulación ULE en drivers/media/dvb/dvb-core/dvb_net.c en dvb-core en el kernel de Linux v2.6.33y anteriores permite a atacantes producir una denegación de servicio (bucle infinito) a través de un marco MPEG2-TS manipulado, relacionado con el payload de un puntero ULE no valido • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=29e1fa3565a7951cc415c634eb2b78dbdbee151d http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html http://secunia.com/advisories/39649 http://secunia.com/advisories/39742 http://secunia.com/advisories/39830 http://secunia.com/advisories/43315 http://support.avaya.com/css/P8/documents/100088287 http://support.avaya.com/css/P8/documents/100090459 http://www.debian.org/security/2010/dsa-2053 • CWE-399: Resource Management Errors CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •