openSUSE

Security Update!
The acroread package was update to fix several security vulnerabilities in the JavaScript engine. (CVE-2008-2992, CVE-2008-2549, CVE-2008-4812, CVE-2008-4813, CVE-2008-4817, CVE-2008-4816, CVE-2008-4814, CVE-2008-4815)

Security Update!
Various bugs such as a get_unicode_name() off-by-one buffer overflow, a bug in URL parsing of phishing checks as
well as minor other issues have been fixed in clamav. (CVE-2008-5050)

Security Update!
Various bugs such as a get_unicode_name() off-by-one buffer overflow, a bug in URL parsing of phishing checks as
well as minor other issues have been fixed in clamav. (CVE-2008-5050)

Security Update!
Squirrelmail was updated to use the secure flag for its cookies.
Otherwise it was possible to hijack a SSL-protected session via
leaked cookies. (CVE-2008-3663)

The previous update for the problem above contained a typo which
broke squirrelmail.

Security Update!
This update fixes a XSS vulnerability in imp. (CVE-2008-4182)

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238). Additionally multiple non-security fixes were added.

Security Update!
This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. (CVE-2008-4226)
Thanks to: Drew Yao of Apple Product Security

Security Update!
This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. (CVE-2008-4226)
Thanks to: Drew Yao of Apple Product Security

Security Update!
This update of phpMyAdmin fixes the following bugs:
- CVE-2008-1149: SQL injection, CSRF attacks using crafted cookies
- CVE-2008-1567: local users can steal session information/credentials
- CVE-2008-1924: in a shared host environment users with CREAT permissions can read arbitrary files
- CVE-2008-3456: cross-site framing attack
- CVE-2008-3457: user-assisted XSS attack

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
This update of flash-player fixes several critical security vulnerabilities. (CVE-2007-6243, CVE-2008-3873, CVE-2007-4324, CVE-2008-4401, CVE-2008-4503, CVE-2008-4546)

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
Remote attackers could exploit memory leaks in the 'racoon' daemon
to crash it (CVE-2008-3651, CVE-2008-3652)

Security Update!
This update fixes a heap-based buffer overflow in libcdaudio that can be exploited remotely to execute arbitrary code.