UbuntuUpdates.org

linux-ec2 (2.6.31-307.17) karmic-security; urgency=low

  [ Stefan Bader ]

  * Rebased to 2.6.31-22.63

  [ Ubuntu: 2.6.31-22.63 ]

  * drm: Initialize ioctl struct when no user data is present
    - CVE-2010-2803
  * can: add limit for nframes and clean up signed/unsigned variables
    - CVE-2010-2959
  * mm: keep a guard page below a grow-down stack segment
    - CVE-2010-2240
  * mm: fix missing page table unmap for stack guard page failure case
    - CVE-2010-2240
  * mm: fix page table unmap for stack guard page properly
    - CVE-2010-2240
  * mm: fix up some user-visible effects of the stack guard page
    - CVE-2010-2240
  * x86: don't send SIGBUS for kernel page faults
    - CVE-2010-2240

 -- Stefan Bader   Wed, 18 Aug 2010 12:33:11 +0200

linux-ec2 (2.6.31-307.16) karmic-security; urgency=low

  [ Stefan Bader ]

  * Rebased to 2.6.31-22.61

  [ Ubuntu: 2.6.31-22.61 ]

  * sctp: Fix skb_over_panic resulting from multiple invalid parameter
    errors (CVE-2010-1173) (v4)
    - CVE-2010-1173
  * sctp: fix append error cause to ERROR chunk correctly
    - CVE-2010-1173
  * GFS2: Fix writing to non-page aligned gfs2_quota structures
    - CVE-2010-1436
  * KEYS: find_keyring_by_name() can gain access to a freed keyring
    - CVE-2010-1437
  * sparc64: Fix sun4u execute bit check in TSB I-TLB load.
    - CVE-2010-1451
  * Btrfs: check for read permission on src file in the clone ioctl
    - CVE-2010-1636
  * GFS2: Fix permissions checking for setflags ioctl()
    - CVE-2010-1641
  * Btrfs: should add a permission check for setfacl
    - CVE-2010-2071
  * ecryptfs: Bugfix for error related to ecryptfs_hash_buckets
    - CVE-2010-2492

 -- Stefan Bader   Tue, 20 Jul 2010 18:07:38 +0200

linux-ec2 (2.6.31-307.15) karmic-security; urgency=low

  [ Stefan Bader ]

  * Rebased to 2.6.31-22.60

  [ Ubuntu: 2.6.31-22.60 ]

  * kvm: restrict writing of segment selectors to segment registers
    - CVE-2010-0419
  * USB: usbfs: properly clean up the as structure on error paths
    - CVE-2010-1083
  * Bluetooth: Fix potential bad memory access with sysfs files
    - CVE-2010-1084
  * ALSA: hda-intel: Avoid divide by zero crash
    - CVE-2010-1085
  * dvb-core: Fix DoS bug in ULE decapsulation code that can be triggered
    by an invalid Payload Pointer
    - CVE-2010-1086
  * GFS2: Skip check for mandatory locks when unlocking
    - CVE-2010-0727
  * tipc: Fix oops on send prior to entering networked mode (v3)
    - CVE-2010-1187
  * inotify: do not reuse watch descriptors
    - LP: #485556
  * idr: fix a critical misallocation bug, take#2
    - LP: #485556
  * tty: release_one_tty() forgets to put pids
    - CVE-2010-1162
  * reiserfs: fix permissions on .reiserfs_priv
    - CVE-2010-1146
  * fix LOOKUP_FOLLOW on automount "symlinks"
    - CVE-2010-1088
  * NFS: Fix an Oops when truncating a file
    - CVE-2010-1087
  * Attempt #2 to handle null nameidata
    - CVE-2010-1148
  * r8169: Fix receive buffer length when MTU is between 1515 and 1536
    - CVE-2009-4537
  * r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)
    - CVE-2009-4537
  * KVM: Use kvm_{read,write}_guest_virt() to read and write segment
    descriptors
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: x86 emulator: Check CPL level during privilege instruction
    emulation
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: x86 emulator: Add Virtual-8086 mode of emulation
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: x86 emulator: fix memory access during x86 emulation
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: x86 emulator: Check IOPL level during io instruction emulation
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: x86 emulator: Fix popf emulation
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: VMX: Use macros instead of hex value on cr0 initialization
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: SVM: Reset cr0 properly on vcpu reset
    - CVE-2010-0298
    - CVE-2010-0306
  * KVM: x86: disable paravirt mmu reporting
    - CVE-2010-0298
    - CVE-2010-0306

 -- Stefan Bader   Tue, 25 May 2010 12:54:39 +0000